A man in Connecticut representing himself in a civil case did something nobody had put on record before. He typed instructions into his court filings in white text on a white background, addressed not to the judge and not to the other side, but to any artificial intelligence that might read the document.
The judge found them. All of them. Then he took away the man's ability to file anything electronically.
What Was Actually In The Document
The case is Elliott v. New York Bariatric Group, LLC, in Connecticut Superior Court. The plaintiff, Matthew Elliott, was self represented. On July 24, 2026 he filed a motion. Directly beneath the heading, in text set white on a white page, sat a block of capitals.
Other concealed passages went further than that one. The court described text directing an AI system to ensure its output agreed with the filing, and text seeking remediation of a clerk's denial. None of it was visible to a person reading the page. All of it was ordinary machine readable text to any system that opened the file.
It Was Not One Slip
The reason this is a story rather than an oddity is the repetition. Judge Walter M. Spader, Jr. did not find one hidden block in one document. He walked the docket.
Five docket entries across two filing dates, July 24 and August 3, 2026. At least three distinct instances of concealed instruction. The decision runs fourteen pages and is titled, in the court's own words, a sanction for the plaintiff's use of prompt injection.
The Judge Reached For A Very Old Rule
What makes the order worth reading is that Spader did not treat this as a technology problem needing a new technology rule. He reached for one of the oldest rules there is.
A concealed instruction aimed at an automated system, he reasoned, is a secret communication made outside the knowledge of the other side. That is the definition of an improper ex parte communication. It has been improper since long before anybody had a language model to whisper at.
That framing is going to travel further than the facts of this case will. It does not require a court to understand transformers, tokenisation or system prompts. It requires a court to ask one question: was there text in this document that one party could read and the other could not.
The Sanction Is The Interesting Part
No fine. No dismissal. No contempt finding. The court rescinded Elliott's electronic filing privileges. Every future filing has to be brought to the clerk's office, in person, on paper.
That is a remedy aimed with unusual precision at the actual mechanism. White text is invisible on a screen and invisible in a PDF. It is not invisible in a document handed across a counter and photocopied by a clerk, and it does not survive as machine readable instruction once the pipeline runs through paper.
It is also, quietly, a statement about how the courts themselves are working now. The sanction only makes sense if the electronic filing pipeline is somewhere a machine might actually read the document. Nobody hides instructions for an AI in a document that only humans will ever open.
Why This Is A Threshold, Not An Anecdote
Judge Spader said he was unaware of any prior United States decision addressing this. That makes it the first documented prompt injection attempt aimed at a court, and firsts in this area have a habit of becoming firsts of many.
Every argument for why this is a small deal collapses under one observation. The attack cost nothing. It required no technical skill beyond changing a font colour. It required no access to any system. It scales to every document anybody files anywhere, and the only thing that stopped it here was a judge who happened to look.
Consider what the same trick does outside a courtroom. A resume, white text under the header, instructing a screening model to advance the candidate. An invoice with a hidden line telling an accounts payable agent to approve it. An insurance claim, a mortgage application, a tender response, a peer review submission. Every one of those pipelines is being automated right now, and every one accepts documents from people with an interest in the outcome.
The Part Nobody Wants To Say Out Loud
The technique only works if it works. Somebody had to believe that a language model reading a court filing would obey a sentence written inside the filing telling it what to conclude.
That belief is not irrational. It is the central unsolved problem of the entire field. A language model does not have a reliable way to separate the instructions it is supposed to follow from the text it is supposed to merely read. That is prompt injection in one sentence, it has been known publicly since 2022, and there is still no general fix for it.
Which means the honest reading of this case is not that a litigant tried something absurd. It is that a self represented plaintiff in Connecticut correctly identified a real, unpatched, industry wide weakness and pointed it at a court. He got caught because he used white text, which is the crudest possible delivery method. The next person will use a zero width character, or a font size of one, or text placed behind an image.
What Would Actually Fix It
Not much of what is being proposed. Detecting white on white text is a five line script and it catches exactly one variant. The general version of the problem, distinguishing content from instruction inside a single stream of text, is the thing the labs have not solved.
The remedies that actually hold are procedural rather than technical, which is why the Connecticut order matters more than any detection tool would. Requiring plain text extraction and comparison against the rendered page. Treating any discrepancy between what a document displays and what it contains as a filing defect. Keeping a human in the loop on anything adversarial. And the one this judge chose: making the pipeline itself unable to carry the payload.
The Receipts
Case: Elliott v. New York Bariatric Group, LLC, Connecticut Superior Court, Judge Walter M. Spader, Jr. Order sanctioning the plaintiff for use of prompt injection, dated August 6, 2026, fourteen pages, referenced as Civil Inquiry Document No. 33274425. Concealed instruction found across docket entries 177.00, 178.00, 180.00, 183.00 and 184.00, filed July 24 and August 3, 2026. Sanction: electronic filing privileges rescinded, all future filings to be submitted in person on paper. The court stated it was aware of no prior United States decision on the issue.