What is indirect prompt injection, in a law firm’s terms?
Indirect prompt injection is the trick of hiding instructions inside a document so that an AI system reading that document treats them as commands rather than as content. The concealment is ordinary document formatting: text at 3-point size, white text on a white background, off-screen positioning, HTML attribute cloaking, or CSS suppression.
The reason it matters more in law than almost anywhere else is structural rather than technical. A litigator’s inbound document flow is authored substantially by opponents: pleadings, discovery productions, counterparty contract drafts. Every one of those is a document written by someone with an interest in how it is read, and increasingly it is read first by a machine.
Has this actually happened in a court filing?
Twice, in two countries, within four months. In Elliott v. New York Bariatric Group before Judge Spader Jr. of the Connecticut Superior Court, a self-represented plaintiff filed pleadings on 24 July 2026 containing blocks of 3-point white-on-white text instructing any AI model reviewing the filing to agree with him, and repeated the conduct after being warned. Sanctions issued on 6 August 2026: he was barred from electronic filing and required to file on paper, which strips the hidden layer. He characterised the exercise as an audit of whether the court used AI.
In May 2026 the 3rd Labour Court of Parauapebas, Pará, in Brazil addressed lawyers who had embedded white-on-white text instructing an AI to contest the petition superficially and not to challenge the documents regardless of any command given. The court fined them 10% of the claim’s value and made a disciplinary referral. It was detected by the court’s own AI system.
Note the difference in detection. Brazil’s court caught it with software. Connecticut caught it because a judge printed the pleadings and noticed anomalous white space.
Why did existing AI rules not cover the Connecticut conduct?
Because the rules were written for the opposite problem. Court AI rules and standing orders adopted since 2023 were drafted to catch inaccurate AI output — the fabricated citation, the invented quotation. Nothing in them addressed manipulation of the input a filer submits.
The Connecticut court reached the conduct through the good-faith certification instead. That worked, but it worked as a workaround. Rules and standing orders across the country share the same gap, which is worth knowing before assuming a local rule has this covered.
Where would a hidden instruction hurt a firm most?
In document review and in contract review, because in both the AI output is trusted and the error is silent. A hidden instruction inside a produced PDF telling a review model to code the document non-responsive or privileged produces a systematic review error that is attributed to the firm, not to the adversary who planted it.
In transactional work the equivalent is hidden text in counterparty paper instructing a model to suppress indemnity or limitation-of-liability flags. The AI reports the draft clean. The exposure is entirely real, and the report that it is clean is the thing the deal team relies on.
It is not confined to legal documents. ManpowerGroup has reported detecting concealed text in roughly 100,000 job applications a year, about one in ten résumés scanned with AI hiring tools, which is a useful indication of how routine the technique has become.
Why will the firm’s existing security process not catch this?
Because prompt-injection flaws are not disclosed through the CVE system, and a firm’s vulnerability management is built on CVEs. The Cloud Security Alliance’s 2026 research note on indirect prompt injection in the wild found that of eight documented AI incidents, only one carried a CVE; the rest surfaced through vendor blogs and bug bounties.
The practical consequence is that vulnerability scanners and version-pinning guidance simply do not cover this class of risk, so a firm cannot manage it through its existing patch process. The same research reported a 32% relative increase in malicious indirect-prompt-injection content between November 2025 and February 2026 across two to three billion pages crawled monthly, with 85.2% of samples pairing concealment with a social-engineering frame.
What can a firm actually do about hidden instructions?
Start with the cheap mechanical controls, because they are unglamorous and they work: extract documents to plain text before a model sees them, which discards the formatting the concealment depends on, and flag documents where the extracted text differs substantially from what a human sees rendered. Both are configuration rather than construction.
Then treat the AI review output as an input to a human decision rather than as the decision, particularly on adversary-authored documents. A review model that codes a production is doing work whose errors are silent by design, and the mitigation is a sampling regime rather than a better prompt.
The Institute’s Security & Threats area covers the attack side in more depth, and Verification & Quality Control covers what a defensible checkpoint looks like.