News analysis

• Hidden instructions in legal filings can target AI tools used by courts and lawyers.
• A Connecticut judge has already sanctioned a litigant for attempting the tactic.
• California’s AI safeguards make verification essential but cannot guarantee immunity from manipulation.

By Samuel López | USA Herald

CALIFORNIA - A secret instruction concealed inside a court filing could influence an artificial intelligence tool reviewing the case—and the concern has already moved beyond speculation.

In August, a Connecticut judge sanctioned a litigant who embedded nearly invisible instructions in court papers to steer any AI reviewing them toward his position. The episode raises a pressing question for California as judges, court employees and attorneys work under new frameworks governing AI use.

Can words a person does not see affect what a machine tells a judge? Technically, yes. Whether they actually do depends on the software, how it reads the document and the safeguards surrounding its output.

The hiring world offers a parallel. Business Insider reported September 6 that an employer discovered approximately 1,500 characters of concealed instructions in a résumé for a legal and compliance position. The text sought preferential treatment from an AI screening system regardless of qualifications.

The security vulnerability is called indirect prompt injection. An AI encounters instructions inside material it was supposed to analyze, then treats those instructions as commands. OWASP, an application-security organization, identifies files as a potential source and warns that attacks can manipulate outputs and critical decisions. OWASP’s explanation

White text on a white background can remain present in an electronic document even when it disappears from ordinary visual inspection. A text-extraction system may pass those words to an AI alongside the visible arguments. Research on hidden prompts specifically identifies the gap between visually displayed documents and machine-readable content. PhantomLint research

That does not mean white ink has special powers or every AI will comply. The concealed content must reach a susceptible system. A scan of a printed page may omit text that survives in the original digital file; another workflow may detect or disregard it.

The Connecticut case illustrates an attempted abuse, rather than proof of a corrupted judgment. In Elliott v. New York Bariatric Group, Judge Walter M. Spader Jr. sanctioned self-represented plaintiff Matthew Elliott and required paper filings after discovering concealed AI-directed text. Elliott characterized his conduct as an audit. The court rejected that justification.

Reporting on the decision states that AI was not being used to review the filings, so the attempted manipulation did not establish that AI influenced the outcome. Court decision, Reuters

California’s framework requires careful distinctions. Effective September 1, 2025, Rule 10.430 required courts permitting generative AI to adopt use policies by December 15, 2025. It covers court staff and judicial officers’ work outside their adjudicative role, with safeguards addressing confidentiality, accuracy, bias and applicable ethical obligations. Rule 10.430

Standard 10.80 separately addresses judicial officers’ adjudicative work. Its advisory language says judges should verify AI-generated material, correct errors, address harmful or biased content and consider disclosure when producing public-facing content. It accommodates AI assistance within safeguards; it does not turn a machine’s recommendation into a judicial determination. Standard 10.80

For attorneys, the State Bar’s updated 2026 practical guidance explains existing professional obligations. Lawyers retain responsibility for independent judgment, confidentiality and accurate submissions, including when using more autonomous AI systems. This guidance is distinct from the court rule governing judicial personnel. State Bar guidance

Applied to litigation, the vulnerability creates several plausible dangers. A compromised summary could omit unfavorable evidence, overstate a declaration’s credibility or distort a proposed order. An opposing lawyer’s AI review could also be targeted. These are potential consequences, not findings that California judges have issued manipulated orders.

The fairness concern is substantial: a party cannot meaningfully challenge an influence it never sees. Human review offers limited protection if the reviewer relies on a polished summary without checking the underlying record.

For courts, practical safeguards would include comparing visible pages with extracted text, flagging concealed instructions, preserving original files and checking summaries against cited evidence. Legitimate accessibility text should not automatically be treated as malicious.

Those measures should accompany restricted system access, separation of document content from operating instructions and testing against adversarial documents. OWASP recommends layered defenses; it does not promise foolproof prevention. OWASP safeguards

The central question for any AI-assisted finding or order is whether its reasoning can be traced to evidence and law that the parties can examine and contest.