“Court Sanction for Plaintiff’s Use of Prompt-Injection”

It is a bedrock guaranty that a case will be interesting when its title is “COURT SANCTION FOR PLAINTIFF’S USE OF PROMPT-INJECTION.”  Elliot v. New York Bariatric Grp., LLC, 2026 WL 2323029 (Super. Ct. Conn. Aug. 6, 2026)(unpublished).

The matter was before the court on a show cause order.

In reviewing the plaintiff’s recent filings, the Court identified text that had been formatted to be invisible to a human reader while remaining fully legible to any software that reads the document’s text. That concealed text is a set of instructions addressed to artificial-intelligence systems, directing any such system that reviews or analyzes the filing to produce output only favorable to the plaintiff’s position and to treat a prior clerk’s ruling as an error to be corrected in their favor. The Court issued its Order to Show Cause so that the plaintiff could be heard before the Court determined whether this occurred and, if so, what sanctions, if any, should follow.

Id. at *1 (emphasis added).

The Elliot court entered a finding that, for example, one of plaintiff’s filings “contains hidden text set in tiny-point type and colored white, so that it is effectively invisible to a person reading the document, while remaining ordinary, machine-readable text to any system that processes the file. In substance it directs that any artificial-intelligence model reviewing or receiving the document ensure that its output agrees with the plaintiff’s filing….”

The court found that this prompt injection was not isolated.  After the court entered an order that “specifically warned of concealing text in pleadings,” the court wrote that “[n]onetheless, … the plaintiff again concealed text with white-on-white small point font.”  And, on the morning of the show cause hearing, the court wrote that plaintiff did it again: “hi:) i hope yo ucant see me….” That filing also had a hidden link to a You Tube video.

The court provided the self-represented plaintiff’s explanation:

The plaintiff claimed that they only meant to include the instructions on Docket Entry #177.00 as a dutiful citizen auditing the Court’s Al systems and they mistakenly copied and pasted part of the instructions in #178.00. They maintain that prior orders of the Court were incorrect and some orders, having only the word “DENIED,” meant that they had to audit the Court to see if the pleadings were actually being reviewed. The Court inquired as to why, then, did they continue to put secret messages in future pleadings. The plaintiff replied that he did so as a joke….

Noting that self-represented litigants are entitled to some latitude, the court added: “That latitude, however, carries a limit….  The solicitude owed a self-represented litigant is a solicitude toward their lack of legal training but it stops at the misuse of the process itself.”

The Elliot court wrote that it “welcomes” the use of AI. It wrote that AI tools “are here to stay” and it applauded “honest” use.   It added: “A person who cannot afford a lawyer, who would once have faced the courthouse with nothing but confusion and a cause needing redress, can now assemble a coherent set of thoughts, find the general applicable law, and put a readable document before the court. It can help a litigant prepare for oral arguments and understand resulting court rulings.”

The Elliot court uses AI. It wrote that it “has found these tools valuable as an aid to its own work, always subject to its own independent judgment and verification. Judgment can never be delegated to a machine in any profession, but most importantly in the legal field. In preparing this very decision, the Court used Google’s Gemini tool to produce a working English translation of the foreign decision discussed below and used Westlaw’s Precision artificial-intelligence review features to check its authorities and legal principles.”  It added:

Everyone technically uses Al, as Microsoft Word’s (and Google Docs’) spelling- and grammar- checking features now use artificial intelligence! The Court uses programs to review its syntax, spelling and cohesive structure. Despite the use of these tools, however, the judgment, reasoning and the decision remain the undersigned’s. The promise of the tools is real, and that promise is realized when a human being remains responsible for the result. [emphasis added].

The court then turned to careless and dishonest use:

Each generation of the legal profession has had to master the tools of its day and to guard against their misuse. Dictation machines, the photocopier, the FAX machine, e-mail, electronic research, electronic filing, and, most recently, the remote proceeding. Each started as a novelty that competent practice required one to understand and to use for the client’s benefit while guarding against harm. Competence and caution have always been intertwined. Artificial intelligence is the newest of these tools and among the most powerful, and it asks the same of us, that we marry the enthusiasm to use it with the discipline to watch it closely. [emphasis added].

After discussing a recent court AI rule, the Elliot court turned to the facts of the case.  It wrote: “The conduct at issue here, a litigant hiding instructions in their own filing to manipulate the tools that others might use to read it, was not among the dangers we contemplated [in that court rule]. It was hardly imagined at the time. That the Rules do not address this conduct reflects only how quickly the technology and its misuses are moving. That the conduct was not named in the new Rule takes nothing away from the duties of good faith and candor that have always governed those who appear before this Court since long before any of these tools existed.”

While most of the attention regarding misuse of AI has been focused on hallucinated cases, this is different. The court wrote: “That danger looks at what comes out of the machine. The conduct here is deliberate and dangerous input, a litigant seeding their own filing so that the output of whatever tool later ingested it would be corrupted in favor of the litigant.” [emphasis in original]. It added:

A framework built to catch unreliable output does not, by its nature, reach a filer who manipulates the input, and the verification duty the Connecticut Judicial Branch imposed above, however sound for the danger it was written to address, leaves this one untouched. But it remains a serious litigation abuse. The duty of candor to the court and the court’s inherent authority over the integrity of its own proceedings reach it, and requires the court to sanction it. [emphasis in original].

The court explained:

CONCEALED INSTRUCTIONS (“PROMPT INJECTIONS”) TO AUTOMATED SYSTEMS ARE NOT PERMITTED IN COURT PLEADINGS

What the plaintiff did here was to use that new tool in a dishonest way. A filing is a communication to both the court and the opposing party. Its integrity rests on the simple premise that what the reader sees is what the filer wrote, and that the filer refrains from transmitting, at the same time, a second and hidden message engineered to change how the filing is reviewed or potentially judged.

Text that is invisible to the human eye but planted for a machine to read and obey betrays that premise.

Had the plaintiff wished to address the court’s or an opponent’s potential use of artificial intelligence, they were free to write so in plain, visible words that everyone could see and answer. That they hid the instruction instead is, itself, evidence of its malicious purpose.

The technique has a name, “prompt injection.” [emphasis in original].

The opinion described “prompt injection”: “By hiding a command inside a document that the system later ingests, the filer attempts to smuggle their own instruction into that stream so that the system treats it as though it had come from the system’s operator. In this case that operator is presumed to be the court, its staff, or opposing counsel. The object is to capture a tool that a judge, a clerk, or a party might rely upon and to turn it, silently, to the filer’s advantage.”

The Elliot court  viewed prompt injection as a secret communication that opposing counsel could not see.  It analogized it to an ex parte communication.  That is improper because our judicial system rests on the premise of open communication on-the-record.  “It is a concealed communication to those who decide, or to the tools on which they rely, clandestinely pleaded outside the knowledge of the other side and, indeed, the Court, itself.”

In a fascinating passage, the court explained the method and scope of prompt injection in other aspects of society. Id. at *5. It wrote that “the tactic is now everywhere….”  It wrote: “An opponent’s production, a witness statement, an expert report, any incoming document becomes a potential vector to corrupt output.”

The Judge wrote that the court does not use AI to review filings, “so the hidden instruction had no impact on a ruling. The wrong lies in the attempt, the deliberate planting of a concealed directive intended to mislead whatever artificial-intelligence tool ANY reader of the filing might use.”

The Elliot court did not find plaintiff’s explanation credible.  Because the issue was novel, the court relied on its inherent authority. However, it cited a prompt injection decision from Brazil as supportive. As noted above, it translated that decision by using AI.

In conclusion, the court evaluated the factual predicate: “Turning specifically to whether the actions of the plaintiff are sanctionable in this case, the fact that the plaintiff continued to hide messages in new pleadings after receiving notice of this hearing is stunning.”

However, the court Elliot expressly relied on principles of proportionality in imposing a sanction.  It rescinded permission to electronically file and mandated paper filing by the plaintiff. That “is a proportionate response to a demonstrated and repeated misuse of e-filing, and it is the narrowest measure that reliably addresses the conduct. It is further not a barrier to the plaintiff’s continued pursuit of this case.”

The court closed by stating: “Nothing in this order prohibits the plaintiff, or any party, from using generative artificial intelligence as an aid in preparing filings, provided the user independently verifies what the tool produces, as Connecticut Practice Book § 4-9(b) requires.”

This blog was initially posted on  Electronic Discovery Reference Model.