A Connecticut court prompt injection attempt has led a judge to bar a self-represented plaintiff from filing electronically. In Elliott v. New York Bariatric Group, Judge Walter M. Spader Jr. found that Matthew Elliott concealed instructions in filings intended for any AI system that might process them, according to the court decision reported by Ars Technica and 404 Media.
The text was set in tiny white type on a white background. That made it close to invisible on the page while leaving it available to software extracting the document’s text. The instructions told an AI reader to make its output agree with Elliott’s position and pursue a result favorable to him, the reports said.
Spader said the Connecticut Judicial Branch does not use AI to review or decide filings. The hidden material therefore did not affect the court’s ruling, and the judge said Elliott’s arguments were considered on their merits. Still, the court found that concealing instructions in a pleading was improper because it created a covert channel outside the ordinary adversarial process.
What is a prompt injection in a court filing?
Prompt injection is the placement of instructions inside material that an AI system may later ingest, hoping the system treats those instructions as part of its operator’s request. In this case, the hidden text was embedded in a legal filing rather than typed directly into a chatbot.
The immediate court system was not the only possible target. A lawyer, party, or other reader using AI to summarize an incoming document could feed the concealed instructions into that tool. That risk is why the conduct can matter even where a court itself is not using AI, according to legal-tech analysis cited in the reporting.
Why did the judge sanction Matthew Elliott?
Elliott, who was representing himself, said the hidden instruction was an audit intended to determine whether the court was using AI. Spader did not accept that explanation. The judge said a person concerned about judicial AI use could raise the issue openly, and viewed the decision to hide the text as evidence of an improper purpose.
The court also found that Elliott continued placing concealed material in later filings after receiving notice of a sanctions hearing. Elliott characterized later hidden messages as jokes, but Spader concluded that unrelated concealed content had no place in pleadings the plaintiff wanted the court to take seriously.
Spader’s August 6 memorandum of decision did not dismiss Elliott’s case or impose a monetary penalty. Instead, it rescinded Elliott’s access to electronic filing and required future pleadings and exhibits to be submitted on paper and in person. The restriction preserved his ability to pursue the case while removing the electronic filing channel the court concluded he had misused.
The judge said he could find no Connecticut or other U.S. decision squarely addressing this conduct, according to Harris Beach Murtha’s account of the ruling. That is a cautious novelty claim, not proof that no earlier episode exists. The practical lesson is less exotic: anyone using AI to read filings needs to account for text that a human reader may not see.
This story draws on original reporting from Ars Technica.
