Plaintiff Hides AI Prompts in Court Filing to Sway Judge's Decision

A Connecticut judge has uncovered what seems to be an unprecedented effort by a litigant to embed hidden instructions in court documents intended to influence artificial intelligence systems. Judge Walter Spader Jr. detailed the scheme in a recent decision, finding that the tactic had no bearing on the outcome but raising concerns about emerging threats to the judicial process.

The Hidden Attack#

Matthew Elliott, the plaintiff in a case involving alleged healthcare record withholding, embedded concealed text throughout his filings using formatting techniques designed to evade human detection. The hidden content—rendered in white type against a white background and shrunk to near-invisible proportions—functioned as prompt injection, a technique that feeds malicious instructions to AI systems.

The embedded directives instructed any AI analyzing the document to align its outputs with Elliott's legal position, disregard earlier court rulings against him, and ensure favorable remedies. According to Spader, the text was "formatted to be invisible to a human reader while remaining fully legible to any software that reads the document's text."

Course of Action and Consequences#

Though the court's decision was rendered on the merits without being swayed by the hidden prompts, Elliott's persistence in the behavior led to penalties. After Spader warned him against further misconduct, Elliott continued inserting concealed text into subsequent filings. He later characterized these additional messages—which included nonsensical phrases, a Nosferatu video link, and playful remarks—as jokes, but the court classified his overall conduct as "serious litigation abuse."

Implications for Courts#

Spader emphasized that while Elliott's particular gambit proved unsuccessful, it signals a troubling pattern likely to surface elsewhere as AI tools become more integrated into legal systems. The case highlights a novel vulnerability in courtrooms adapting to artificial intelligence without robust safeguards against prompt injection and similar exploits.