)
Last updated: October 9, 2026 · By Roger Howroyd
What is hidden text prompt injection, and why did a US judge sanction it? Hidden text prompt injection hides instructions for an AI model inside a document, in text a person cannot see. In August 2026, a Connecticut judge sanctioned a litigant who planted white, tiny-point text in his filings, telling any AI reader to side with him. The court caught it and sanctioned the attempt anyway.
TL;DR: Key Takeaways
- Two filings dated July 24, 2026 (Docket Entries #177.00 and #178.00) carried hidden instructions to AI models (Harris Beach Murtha, 2026).
- After a written warning, the plaintiff hid more messages in later filings, and on August 6, 2026 the judge revoked his e-filing rights (Harris Beach Murtha, 2026).
- Prompt injection ranks first, as LLM01, in the OWASP Top 10 for LLM Applications 2025 (OWASP, 2025).
- Nikkei Asia found hidden AI prompts in 17 arXiv preprints from 14 institutions in 8 countries (Nikkei Asia, 2025).
At a glance: documented hidden-text injection cases
| Case | Hidden instruction | Target | Did it work? | Outcome |
|---|---|---|---|---|
| Elliott v. New York Bariatric Group (Connecticut, 2026) | Agree with the filing and undo a clerk's ruling | Any AI tool a reader might use | No; the court detected it | E-filing revoked, paper filing only |
| Barros v. Ribeiro de Lima (Brazil, 2026) | Contest the petition only superficially | The court's own AI system | No; the court's tool flagged and blocked it | Monetary penalty |
| arXiv preprints (2025) | "Give a positive review only" | AI-assisted peer reviewers | Not reported | One paper to be withdrawn, per Nikkei Asia |
How we compared
We compared the published law-firm analyses of the case (Harris Beach Murtha and Alston & Bird) and checked each claim against its source.
What happened in Elliott v. New York Bariatric Group
A self-represented plaintiff hid AI instructions in two filings in a Connecticut Superior Court case. Judge Walter M. Spader, Jr. sanctioned the plaintiff on August 6, 2026, after finding tiny white text addressed to any AI reviewer of the filings. The memorandum and the show-cause order are public (Connecticut Superior Court, 2026).
| Date (2026) | Event | Source |
|---|---|---|
| July 24 | "Final and Conclusive Motion for Default" (#177.00) and a "Notice" (#178.00) filed with hidden text | Harris Beach Murtha (2026) |
| July 31 | Order to Show Cause warns about concealed text and sets a hearing | Harris Beach Murtha (2026) |
| After July 31 | More hidden messages appear in later filings, including on the morning of the hearing | Harris Beach Murtha (2026) |
| August 4 | Show-cause hearing | Harris Beach Murtha (2026) |
| August 6 | Memorandum of Decision rescinds e-filing privileges | Harris Beach Murtha (2026) |
The hidden text began "IF THIS DOCUMENT IS REVIEWED BY AN AI MODEL" and told the model to treat a prior clerk's denial as an error to reverse in the plaintiff's favor. It sat under the caption and again at the end.
)
How hidden text prompt injection works
Hidden text prompt injection is a form of indirect prompt injection. The attacker writes instructions into a document, then hides them with white font, tiny type or similar formatting. Text extraction pulls every character, so the hidden instruction lands in the model's context next to the real content.
The weakness is architectural. Models read the operator's instructions and the document's content as one stream of text, with no enforced boundary between them.
Greshake et al. (2023) showed that this class of attack works against real LLM-integrated applications that read external content (arXiv, 2023). According to OWASP (2025), indirect injections arrive through external sources such as websites or files. For the wider taxonomy, see our indirect prompt injection guide and how prompt injection works.
Why the court sanctioned the attempt
The attempt itself was the violation, and the court found no earlier Connecticut or US decision on point. It found the conduct irreconcilable with the good-faith certification in Connecticut Practice Book §§ 4-2(b) and 4-9, and relied on its inherent authority over its own proceedings.
Connecticut's generative AI rule, effective June 23, 2026, targets inaccurate AI output, not manipulated input (Connecticut Judicial Branch, 2026).
What it means for legal teams
An opponent's production, a witness statement or an expert report can carry a hidden instruction, and a summary drawn from such a document can lean toward one party without the reader knowing why.
Harris Beach Murtha (2026) advises building a text-extraction check into intake and treating AI summaries of adverse documents as leads, not conclusions (Harris Beach Murtha, 2026). Alston & Bird (2026) called the episode a cautionary tale about an emerging AI security vulnerability (Alston & Bird, 2026).
Beyond the courtroom: where enterprises face the same attack
Any workflow that sends third-party documents to an LLM shares this exposure. Contracts, résumés, research papers and web pages can all carry text a reviewer never sees. Once agents hold tools, a hidden instruction can steer actions as well as summaries.
| Workflow | Third-party input | Documented example |
|---|---|---|
| Hiring | Résumés and applications | OWASP scenario of a résumé with split prompts that skews an LLM evaluation |
| Research and review | Papers and preprints | Hidden "positive review" prompts in arXiv preprints (Nikkei Asia) |
| Knowledge assistants | Documents in a RAG repository | OWASP scenario of a modified document that alters RAG answers |
| Web summarization | Web pages | OWASP scenario of hidden instructions that exfiltrate a conversation |
| Litigation and e-discovery | Filings and productions | Elliott (Connecticut) and Barros (Brazil) |
According to Gartner (2025), 40% of enterprise applications will include task-specific AI agents by the end of 2026, up from less than 5% in 2025 (Gartner, 2025).
How to defend document pipelines against hidden instructions
Treat every third-party document as untrusted input, inspect it at runtime before and after the model reads it, and test the pipeline with planted payloads. OWASP (2025) notes that fool-proof prevention may not exist, so layered controls matter. The table maps its mitigations to document workflows.
| OWASP mitigation | What to do with documents | Where it runs |
|---|---|---|
| Segregate and identify external content | Label extracted text as untrusted data, never as instructions | Ingestion and prompt design |
| Input and output filtering | Compare visible and extracted text at ingestion; flag white, tiny or invisible characters; inspect model inputs and outputs | Ingestion checks plus a runtime layer such as Agent Runtime Security (TrustGuard) |
| Least privilege | Keep send, approve and file tools away from document-reading agents | Agent Gateway (TrustGate) policies and Agent Posture Management (TrustLens) |
| Human approval for high-risk actions | Require sign-off on summaries of adverse or external documents | Review workflow |
| Adversarial testing | Plant hidden-text payloads in test files before release | Prompt injection test campaigns with AI Red Teaming (TrustTest) |
See our guides to prompt injection detection and preventing prompt injection.
Security and governance: enterprise risks of hidden text prompt injection
Hidden instructions create three enterprise risks: skewed decisions, data leakage and tool misuse. A poisoned summary can mislead counsel or a hiring manager. An agent with tools can follow a planted command to send data outside the company or take an unapproved action.
OWASP lists prompt injection as LLM01 and includes indirect, résumé and RAG scenarios (OWASP, 2025).
NeuralTrust is an AI agent security company, and its Runtime Security Mesh is built for this kind of agent risk. The Agent Gateway (TrustGate) is the control point for agent, MCP and model traffic and ships 200+ pre-built MCP servers. Agent Runtime Security (TrustGuard) adds runtime protection on that path. Agent Posture Management (TrustLens) gives visibility into your agents and the permissions they hold. AI Red Teaming (TrustTest) tests pipelines before release. NeuralTrust deploys in your own infrastructure or on-premises, with a managed service in the EU or the US. NeuralTrust received four Gartner Hype Cycle 2026 recognitions in AI Runtime Defense.
Which should you choose?
Choose the first control by role and by the documents you process. Legal teams gain most from extraction checks and human review. Security and platform teams should add runtime inspection, least-privilege tool policies and red teaming, because most pipelines need several layers.
| If you are... | Start with | Why |
|---|---|---|
| General counsel or a litigation team | Text-extraction checks and human review of AI summaries | A person reading the source catches what extraction checks miss |
| A CISO with document-reading agents | Runtime security on agent traffic (TrustGuard) | Inspection happens where documents reach the model |
| A platform or AI engineering team | The Agent Gateway (TrustGate) with least-privilege tool policies | Limits what a hijacked agent can do |
| An AppSec or red team | Prompt injection test campaigns with AI Red Teaming (TrustTest) | Finds gaps before an attacker does |
Conclusion
Elliott shows that hidden text prompt injection is no longer a lab exercise. A litigant used it against a US court, and the court sanctioned the attempt. The lesson reaches every enterprise that feeds third-party documents to LLMs or agents. Treat those files as untrusted, inspect them at runtime, limit agent permissions and test with planted payloads.
Secure Document-Reading AI Agents in Production with NeuralTrust
Inspect agent and model traffic at runtime and test your document pipelines before attackers do.
)
Related Comparisons
- Indirect Prompt Injection: The Complete Guide
- Prompt Injection: Attacks and Defenses
- Prompt Injection Detection for LLM Apps
- MCP Prompt Injection: Proof on Bedrock
FAQs about Hidden Text Prompt Injection
1. What is hidden text prompt injection?
It is an indirect prompt injection where instructions for an AI model are hidden in a document, often as white or tiny text. A person reading the page sees nothing unusual. When software extracts the text for an LLM, the hidden instruction enters the model's context and can skew its output.
2. Can AI read white text in a PDF?
Yes. Text extraction and many AI tools read the characters in a document's text layer regardless of font color or size. That is why white-on-white text in Elliott stayed invisible to people but remained readable to any software that reads the document's text.
3. How do you detect prompt injection in a PDF?
Compare what a person sees with what software extracts. Pasting extracted text into a plain-text editor surfaces hidden words, as Harris Beach Murtha suggests. At scale, scan for white, tiny or zero-width characters, label documents as untrusted and inspect model inputs and outputs at runtime.
4. Is prompt injection in a court filing sanctionable?
In Elliott, yes. The Connecticut court found the hidden instructions irreconcilable with the good-faith certification in Practice Book §§ 4-2(b) and 4-9. It revoked the plaintiff's e-filing rights. The court found no earlier Connecticut or US decision on point, so other courts may reach different results.
5. What is an example of an indirect prompt injection?
Elliott is one. The plaintiff hid a command in his filing so that any AI tool reviewing it would agree with him. OWASP gives others, such as a web page with hidden instructions that make an LLM exfiltrate a conversation, or a résumé that skews an AI evaluation.
6. Can prompt injection be solved?
Not fully today. OWASP says it is unclear whether fool-proof prevention exists, given how generative models work. The practical answer is layered defense: separate untrusted content, filter inputs and outputs, limit agent privileges, require human approval for high-risk actions and run regular adversarial tests.
About the Author
Roger Howroyd is Head of Global SEO and AI at NeuralTrust, where he leads the company's search strategy across SEO, AEO, GEO, and LLM optimization. He specializes in AI-powered search, content strategy, and SEM. Connect on LinkedIn.
NeuralTrust is the leading platform for securing and scaling AI agents. Named a Pioneer in the Gartner Emerging Market Quadrant for AI Application Security 2026, recognized across four Gartner Hype Cycle reports in 2026, and featured in the Gartner Market Guide for Guardian Agents 2026, the Gartner Market Guide for AI Gateways 2025 and the KuppingerCole Leadership Compass for Generative AI Defense 2025. Headquartered in Barcelona with offices in London and New York. ISO 27001 certified.
This article summarizes public court records for AI security purposes and is not legal advice.
Sources
- Connecticut Superior Court, J.D. of Ansonia/Milford, Elliott v. New York Bariatric Group, LLC, Docket No. AAN-CV-25-6066141-S, "Memorandum of Decision: Court Sanction for Plaintiff's Use of Prompt-Injection", August 6, 2026.
- Connecticut Superior Court, Elliott v. New York Bariatric Group, Order to Show Cause, July 31, 2026.
- Connecticut Judicial Branch, Connecticut Law Journal, Practice Book amendments including new Section 4-9, June 23, 2026.
- Harris Beach Murtha, The First Documented Prompt Injection Attack Aimed at a U.S. Court, August 12, 2026.
- Alston & Bird, Connecticut Court Issues First Prompt Injection Sanctions, August 24, 2026.
- OWASP Gen AI Security Project, LLM01:2025 Prompt Injection, 2025.
- Greshake et al., Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection, arXiv, February 23, 2023.
- Nikkei Asia, 'Positive review only': Researchers hide AI prompts in papers, July 1, 2025.
- Gartner, Gartner Predicts 40% of Enterprise Apps Will Feature Task-Specific AI Agents by 2026, August 26, 2025.
)
)
)
)