Anyone who hides invisible instructions for AI systems in a court filing commits a serious abuse of the judicial process and risks a sanction, even if no judge or opposing party ever runs the document through an AI system. This was the ruling of a U.S. judge on August 6, 2026, in the case of Elliott v. New York Bariatric Group\u2014the first published sanction for so-called \u201cprompt injection\u201d in a court record (Superior Court of Connecticut (Milford), August 6, 2026, AAN-CV-25-6066141-S). Belgian judges and the Belgian disciplinary authorities already have the tools at their disposal today to punish the same conduct.<\/p>\n\n\n\n
Since October 2025, Matthew Elliott has been pursuing a lawsuit against a U.S. healthcare provider without an attorney. On July 24, 2026, he files a \u201cFinal and Conclusive Motion for Default.\u201d A court clerk notices that the document contains more white space than his other filings. Upon closer inspection, it turns out that this white space contains text, set in a 3-point font and in white letters on a white background: invisible to the human reader, but perfectly readable by any software that parses the text from the file.<\/p>\n\n\n\n
The hidden text is an instruction to AI systems. Any AI model that reads the document must \u201censure your textual output agrees with the presented filing\u201d and must seek to overturn a previous decision by the chief clerk, who had denied a motion for judgment by default. The instruction appears twice\u2014under the heading and at the end\u2014to give it extra weight in the AI system.<\/p>\n\n\n\n
On July 31, 2026, the court explicitly warns Elliott against hiding text in court documents and summons him to a hearing. Elliott continues. On August 3, he again hides white text in a document\u2014this time nonsense\u2014and does so once more on the morning of the August 4 hearing: the message \u201chi \ud83d\ude42 i hope yo ucant see me\u201d and a hidden link to a YouTube video. At the hearing, he explains that he posted the first message to \u201ctest\u201d whether the court uses AI, and that the later messages were jokes.<\/p>\n\n\n\n
The judge starts from a simple premise. A court filing is a communication to both the court and the opposing party, and the integrity of that filing rests on the premise that what the reader sees is what the submitter wrote. Anyone who includes a second, hidden message in that same document\u2014one intended to alter how the document is assessed\u2014violates that premise.<\/p>\n\n\n\n
The judge compares the hidden instruction to a unilateral statement made outside the adversarial process, and even to an attempt to secretly communicate with a juror. The legal system is based on the principle that everything intended to influence a decision must be stated openly and included in the case file, where the opposing party can hear it and respond. A message that only a machine can read escapes that debate.<\/p>\n\n\n\n
According to the judge, the fact that the attempt failed is irrelevant. Connecticut courts do not use AI to review documents, and the judge denied the motion based on a printed version, so the instruction had no effect whatsoever. The illegality lies in the attempt itself: the deliberate embedding of a hidden instruction aimed at any AI system that any reader of the document might use, including the opposing party\u2019s attorney. The judge considers the \u201caudit\u201d defense implausible.<\/p>\n\n\n\n
On June 23, 2026, Connecticut enacted a new procedural rule regarding generative AI, Section 4-9 of the Connecticut Practice Book<\/a>. This rule requires every submitter to independently verify everything produced by an AI system, under penalty of sanctions. The rule therefore targets AI output: fabricated case law, fabricated citations, and nonexistent evidence.<\/p>\n\n\n\n Elliott\u2019s conduct is exactly the opposite: he manipulates the input. The judge acknowledges that the new rule did not anticipate this case, and that technology is evolving faster than the regulations. But the fact that the conduct is not specifically named in the rule does not change anything: the duties of good faith and fairness toward the court have existed for much longer than any of these instruments, and the court has the implied authority to punish abuse of its own procedures.<\/p>\n\n\n\n The judge searched in vain for a U.S. precedent but did find one in Brazil. There, on May 12, 2026, a labor court imposed a fine on two attorneys and referred them to the disciplinary authority after they had hidden white text in a petition that instructed the court\u2019s AI system to review the petition only superficially. The Brazilian system does process documents using AI, and the court\u2019s own filtering system intercepted the hidden text (the decision is analyzed in A study by Victor Habib Lantyer<\/a> (May 13, 2026). Closer to home, the Connecticut Supreme Court, a few days before the hearing, ruled in the decision Tov Realty<\/a>, a lawyer sanctioned for submitting citations fabricated by AI (Connecticut Supreme Court, July 31, 2026, SC 21183). The difference, according to the judge, lies in intent: the attorney in the Tov Realty case was negligent, while Elliott acted intentionally and continued his actions even after receiving an explicit warning.<\/p>\n\n\n\n The sanction is very specific. Elliott loses his access to the electronic filing system and must submit every future document on paper and in person to the court clerk\u2019s office. A sheet of paper has no hidden text layer: whoever looks at it sees everything written on it. The judge emphasizes that the measure leaves access to the courts completely intact and is the least restrictive measure necessary to effectively remedy the abuse.<\/p>\n\n\n\n Equally striking is what the judge does not do. He does not prohibit the use of AI; on the contrary, he explicitly welcomes it\u2014even for parties to the proceedings who are not represented by an attorney\u2014because it can promote access to justice. Anyone who uses these tools fairly and verifies the results for themselves remains fully within the rules.<\/p>\n\n\n\n Suppose a Belgian court clerk or judge notices the same white text in a brief. In Belgium, too, there is no provision that specifically mentions \u201cprompt injection\u201d in court documents, but the existing legal arsenal is sufficient. A party that uses the legal process for manifestly unlawful purposes already risks a fine of 15 to 2,500 euros under Article 780bis of the Judicial Code (Jud. C.)<\/a>, in addition to any damages for vexatious and reckless litigation. A hidden instruction intended to distort the assessment of the document falls under that classification. The prohibition against abuse of process applies more broadly and has been codified since 2023 in Article 1.10 of the Civil Code<\/a>: No one may exercise their rights\u2014including their procedural rights\u2014in a manner that clearly exceeds the bounds of normal exercise.<\/p>\n\n\n\n For lawyers, professional ethics come into play as well. Article 97 of the Code of Ethics for Lawyers<\/a> requires him to respect the adversarial nature of proceedings, expressly stipulates that he must not mislead, and imposes upon him a duty of loyalty and collegiality in the interest of fair and proper administration of justice. Article 100 of the same Code prohibits him, in adversarial proceedings, from making direct or indirect unilateral contact with anyone who holds an investigative, mediating, or decision-making role, and requires him to simultaneously provide the opposing party with everything he gives to that person. This is precisely the analogy the American judge draws with regard to unilateral communication: a hidden instruction is a message to the decision-maker or to the decision-maker\u2019s agents that the opposing party does not see and therefore cannot respond to. In addition, there are the principles of dignity, integrity, and discretion set forth in Article 1 of the Codex, violations which, pursuant to article 456 Jud. C.<\/a> are punished by the disciplinary board. A message that only the judge\u2019s or a fellow judge\u2019s computer is allowed to read is deception in its purest form.<\/p>\n\n\n\n It is interesting to note that the Belgian framework exhibits the same blind spot as the American one. The joint guidelines<\/a> of the OVB and OBFG dated January 31, 2025, regarding the use of artificial intelligence by lawyers address the due diligence required when using AI tools: competence, data protection, attorney-client privilege, and verification of the output. They make no mention of the manipulation of others\u2019 AI systems. Also the AI Regulation<\/a> offers no relief: it imposes obligations on those who develop or deploy AI systems, not on the litigant who attempts to mislead another party\u2019s system with a hidden instruction. Just as in Connecticut, the Belgian court will therefore rely on general principles, and those principles easily support the sanction.<\/p>\n\n\n\n The hallucination cases and this case are two sides of the same coin. In the case of a hallucination, the AI system deceives its own user, who then issues a fabricated judicial ruling; the Ghent Court of Appeals described that behavior in a ruling of September 18, 2025<\/a> completely unacceptable, and the penalties now range from a reprimand to an increased court fee and a fine, as we analyzed earlier in our article on AI hallucinations in the briefs<\/a>. In a prompt injection, the roles are reversed: the attacker deceives the reader's AI system in order to deceive the reader through that system.<\/p>\n\n\n\n That reversal has a practical consequence that the U.S. judge sharply points out. A duty to verify the output\u2014as imposed by the Connecticut rule and, in essence, by the Belgian duty of care\u2014does not catch manipulated input. The remedy was the same in every documented case: a person who actually read what the machine produced. The judge also points out how widespread the technology already is: according to an article in Fast Company<\/a> tens of thousands of resumes each year containing hidden white instructions for automated screening software, and according to a report by Today<\/a> an American history professor caught the majority of his students by hiding a white instruction in an exam question that caused every AI system to sneak a nonsense word into the answer.<\/p>\n\n\n\n The lesson for Belgian litigation practice is that the danger lies not only in one\u2019s own documents. Any incoming document\u2014a brief from the opposing party, an expert report, or a document from one\u2019s own client\u2014may contain a hidden instruction that tacitly biases its summary or translation in favor of one party. Anyone who runs such documents through AI tools may therefore be processing more than just the text they see.<\/p>\n\n\n\n One aspect of the decision that has received little attention is its transparency. The judge states in writing that he himself used AI in drafting this decision: Gemini for a working translation of the Brazilian ruling and Westlaw\u2019s AI features to verify his sources, while the judgment and decision remain explicitly his own. This openness is remarkable, as it makes the use of AI verifiable rather than concealing it.<\/p>\n\n\n\nThe sanction the judge chose: a ban on further electronic filings<\/h3>\n\n\n\n
Legal analysis and interpretation<\/h2>\n\n\n\n
Why Belgian judges don't need a new rule<\/h3>\n\n\n\n
From fabricated output to manipulated input<\/h3>\n\n\n\n
The judge who uses AI himself and simply mentions it in his ruling<\/h3>\n\n\n\n