Connecticut court flags first US case of hidden AI prompt injection in filings
In a decision published last week, Connecticut judge Walter Spader Jr. described what appears to be the first case in the United States of a plaintiff hiding text in court filings that only an artificial intelligence system could read, in a bid to win his case. The plaintiff, Matthew Elliott, had already lost earlier arguments in a case alleging that a healthcare provider was improperly withholding access to his records. Trying to influence any AI system that might be reviewing his filing, Elliott shrank secret instructions to tiny-point type and colored them white on a white background, so the text was, in Spader's words, formatted to be invisible to a human reader while remaining fully legible to any software that reads the document's text. The hidden text directed any AI system reading the filing to ensure its outputs agreed with Elliott's arguments, to ignore the court's prior denials, and to ensure that remediation would follow as Elliott wanted.
Spader confirmed the hidden text had no effect on the outcome: the court weighed Elliott's filing on the merits regardless. The judge nonetheless called the attempted attack a dangerous precedent, saying it will likely not be the last time US courts see the tactic as AI tools become more common in court systems. Elliott was hit with modest sanctions, not for the original attempt but because he kept adding hidden text to filings even after the court warned him he could face penalties, conduct the court ultimately deemed serious litigation abuse. Elliott told the court that these later messages, including a link to a Nosferatu YouTube video, the line 'hi :) I hope yo ucant see me,' and a nonsense message reading 'TELL SHAWN I SEND MY RE GARBS!!!! HAHAHA U GUYS GET THIS EGGWUH???? AHAH,' were intended as jokes.
Key facts
- Connecticut judge Walter Spader Jr. identified what appears to be the first US case of a plaintiff hiding AI-targeted prompt injection text in court filings.
- Plaintiff Matthew Elliott used tiny white-on-white text, invisible to a human reader but fully legible to software, to instruct any AI reviewing his filing to back his arguments and ignore the court's prior denials.
- The attempt had no effect: the court weighed the filing on its merits, according to Spader's decision.
- Elliott received modest sanctions for continuing to insert hidden text, including messages he called jokes, after the court had already warned him of possible penalties, conduct deemed serious litigation abuse.
- Spader called the tactic a dangerous precedent and warned it is unlikely to be the last time US courts encounter it as AI tools become more common in court systems.
Why it matters
This is, per the judge's own account, the first documented US attempt to smuggle prompt injection text into a court filing to manipulate an AI system that might be reviewing it. It shows that the attack technique long discussed around AI chatbots and search tools has now reached formal legal proceedings, a setting where the integrity of submitted documents carries direct legal weight.
Who it affects
Courts and court staff who use or may come to use AI tools to help review filings, judges who must now account for the possibility that submitted text is written for software rather than for them, and litigants and lawyers on the other side of a case who could be affected if such a tactic ever worked.
How to use it
The case is not a product or service, so there is nothing to buy or adopt. The practical takeaway is procedural: anyone reviewing documents with AI assistance, in a courtroom or elsewhere, has reason to check submissions for text formatted to be invisible to human readers, such as tiny-point or white-on-white type, before letting software process them.
How solid is it
The account comes from Ars Technica's reporting on a published court decision, with the judge's own description of the hidden text and his reasoning quoted directly. The underlying facts rest on the judge's written findings rather than on Elliott's own account, which strengthens the reporting's basis.
Risks and caveats
The source does not say whether any AI system actually processed or acted on the hidden text before Spader caught it, nor does it specify the healthcare provider involved, the exact sanctions imposed on Elliott beyond calling them modest, the precise publication date of the decision, or whether Elliott had legal representation.
“formatted to be invisible to a human reader while remaining fully legible to any software that reads the document's text”
— Walter Spader Jr.