In August, a Connecticut Superior Court issued what appears to be the first reported U.S. judicial sanction for prompt injection in litigation, and the decision carries consequences that extend well beyond the self-represented plaintiff who triggered it.

In Elliott v. New York Bariatric Group, LLC, Docket No. AAN-CV-25-6066141-S (Conn. Super. Ct. Aug. 6, 2026), Judge Walter M. Spader, Jr. found that the plaintiff had repeatedly embedded hidden white-on-white text in court filings, text invisible to any human reader but fully legible to AI systems, directing any AI tool that processed the documents to produce output favorable to the plaintiff and to reverse a prior clerk's ruling. The plaintiff continued embedding concealed content even after the court issued an Order to Show Cause and specifically warned that sanctions were under consideration. The court revoked the plaintiff's e-filing privileges, requiring all future submissions to be made in person on paper.

What Makes This Decision Significant

The Elliott ruling is notable for several reasons that distinguish it from existing commentary on prompt injection risk.

First, it is a U.S. court decision. Until now, the only reported judicial sanction for prompt injection in litigation came from Brazil's labor courts, where, in Elisandro Martins de Barros v. Renato Ribeiro de Lima (TRT-8, May 12, 2026), two attorneys embedded a hidden Portuguese-language instruction directing the court's AI system to review their petition only superficially. That court imposed a monetary fine equivalent to roughly $16,500 USD and referred the lawyers to disciplinary authorities. Judge Spader cited the Brazilian decision directly, but grounded his ruling in Connecticut law and his court's inherent authority, making clear that existing good-faith and candor obligations reach this conduct even without a rule specifically naming it.

Second, the conduct here was deliberate and repeated. The plaintiff admitted placing the initial injection intentionally. After receiving the court's warning, the plaintiff continued hiding text in subsequent filings. That pattern drove the court's response: what might have drawn a minimal sanction as a first offense warranted a firmer remedy after repeated, knowing violations.

Third, the court addressed AI use by counsel directly, warning that any incoming document, an opposing production, an expert report, even a client-supplied record, can now serve as a vehicle to corrupt whatever AI tool a lawyer uses to process it. A summary or analysis drawn from a document carrying a hidden instruction may skew silently toward one party's narrative while counsel remains unaware of the cause.

How This Differs from the Broader Conversation

Published commentary on prompt injection, including detailed analyses of trade secret, employment, and cybersecurity exposure, has framed the primary threat as external: a competitor extracting proprietary AI system instructions, a bad actor manipulating a hiring tool, or a supply-chain attack compromising enterprise data. Those risks are real. But Elliott surfaces a different and more immediate threat for litigators: the opposing party's own filings, or documents produced in discovery, may be the attack vector. No sophisticated technical infrastructure is required. The tool is a word processor and the target is whoever reviews the document with AI assistance.

Key Takeaways

• The attempt is sanctionable regardless of success. Judge Spader and the Brazilian court both held that the wrong is complete when the hidden instruction is filed, not when it achieves its intended result. 
• Existing obligations already reach this conduct. Connecticut Practice Book rules on AI use address output verification, not input manipulation. But the court found the duty of candor and the court's inherent authority sufficient. Federal practitioners face parallel exposure under Fed. R. Civ. P. 11 and Model Rules 3.3, 3.4, and 8.4(d).
• Every incoming document is a potential injection vector. Counsel who rely on AI tools to summarize, translate, or analyze opposing filings, discovery productions, or third-party documents should treat any unexpected or counterintuitive output as a reason to inspect the source document for hidden text before acting on the result.
• Detection is straightforward. A select-all command, a paste into a plain-text editor, or a high-contrast PDF view will reveal most white-on-white injection attempts. That simple step should become a routine part of any AI-assisted document review workflow.
• Most current AI use policies focus on what employees may input into AI tools. Elliott confirms that what others feed into your tools, through documents you receive and process, is also a risk.

What to Watch

The court's order was deliberately narrow, revoking e-filing access rather than imposing monetary sanctions or dismissing the case. That restraint reflects the self-represented plaintiff's status and the absence of demonstrated harm to an actual ruling. In a case involving counsel, or where hidden instructions actually corrupted a court's or opponent's AI-assisted analysis, the consequences would almost certainly be more severe. Businesses and their lawyers should expect further U.S. decisions to develop this area quickly, particularly as AI-assisted document review becomes standard practice across litigation, regulatory matters, and transactional due diligence.