Pro se plaintiff hid AI instructions in court filings to sway automated review

Matthew Elliott, a pro se (self-represented) plaintiff in Connecticut, filed suit against New York Bariatric Group in October 2025, alleging data privacy violations and discrimination. Within his official court filings, he embedded hidden prompt injection instructions—messages written in 3-point white text on a white background, invisible to the human eye but fully readable by any AI system processing the document. The hidden text directed a hypothetical AI reviewer to ensure its output aligned with Elliott's filing and to treat a prior clerk's denial as an error that needed correcting.

The scheme unraveled when the court noticed unusual amounts of whitespace in Elliott's submissions. Upon investigation, Judge Walter Spader Jr. discovered the near-invisible text and scheduled a hearing to address the discovery. The judge explicitly warned Elliott against hiding text in court documents. Elliott ignored the warning. In subsequent filings, he again embedded hidden messages—including a YouTube link and mocking comments. When questioned, Elliott claimed the original prompt injection was merely an "audit" of a possible AI review system, and the later messages were simply "invisible jokes."

In his 14-page ruling, Judge Spader made clear that Connecticut courts do not use AI systems to review or rule on filings, so Elliott's hidden instructions had no practical effect on the case outcome. However, the attempt itself constituted misconduct. Spader compared it to "arrange[ing] for an automated agent to communicate covertly with a juror during trial"—a plainly improper act. He emphasized that hidden instructions represent covert communication aimed at decision-makers or the tools they rely on, and that the attempt violated court integrity regardless of success. At the same time, Spader explicitly welcomed the use of AI tools for preparing filings, noting they give unrepresented people new ways to present cases clearly. He distinguished between honest use and dishonest manipulation, and cautioned that language models can reinforce flawed legal reasoning because they tend to develop a user's arguments persuasively rather than challenge them.

As a sanction, the court stripped Elliott of his electronic filing privilege. He must now submit all filings and exhibits in person, on paper, to the clerk's office. Elliott protested the sanction as unfair, pointing out that scanned paper documents could also contain hidden text. Judge Spader referenced a parallel case in Brazil, where two lawyers had hidden shrunken white text on a white background in a filing to manipulate the court's own AI system—a prompt injection that the court's system detected and blocked before processing. The broader problem extends beyond courtrooms: last year, Nikkei discovered hidden instructions like "positive review only" or "no criticism" embedded in 17 preprints on arXiv, all formatted in white text on white backgrounds or tiny fonts to skew AI-powered peer reviews in the authors' favor. Elliott's case adds another dimension to a growing trend in which AI is not just helping people draft documents, but also becoming a target for covert manipulation within those very documents.