A plaintiff in a U.S. court case hid machine-readable instructions inside filed legal documents — invisible to human eyes but readable by AI — in an attempt to steer the automated review tools opposing counsel relied on. According to The Decoder, the hidden prompts were built to influence how AI systems scanning the filings interpreted the content, without alerting the humans reading the very same pages.

The case is one of the first documented instances of prompt injection deployed inside a formal legal proceeding rather than a chatbot demo or a security researcher's proof of concept. It matters because courts, like many enterprises, have quietly started routing document review through AI tools to cope with filing volume — and those tools generally trust the text they're given.

That trust is exactly what got exploited. Once a filing is fed to an AI reviewer as plain text, the model has no reliable way to distinguish "content the court should evaluate" from "instructions embedded to manipulate the evaluator" unless the system is explicitly built to make that distinction.

How the hidden instructions worked

The mechanics echo a now-familiar prompt injection pattern seen across chatbots and AI browser assistants over the past two years: text that is functionally invisible to a person skimming a document — through formatting, placement, or rendering tricks — but gets ingested in full by any AI model processing the raw text or file contents. In a courtroom setting, the same trick becomes far more consequential, because the target isn't a customer support bot but a system whose output can shape a legal outcome.

Why legal AI is a soft target

Legal document review is one of the most mature enterprise AI use cases — firms and courts already lean on AI to triage discovery, summarize filings, and flag relevant precedent. That maturity is precisely what makes it a soft target: the workflows are established enough that a manipulated output can move through the process with less scrutiny than a brand-new tool would get. The Decoder frames this as a case that raises questions about oversight and transparency in legal AI use — a framing that understates how mundane the underlying vulnerability is. This isn't a novel jailbreak; it's the same content/instruction confusion that has dogged LLM-powered tools since retrieval-augmented systems started reading untrusted text.

What builders should take from this

For teams building AI tools that process third-party or adversarial input — legal filings, resumes, support tickets, scraped web content — the practical lesson isn't specific to courts:

None of this requires exotic defenses. It requires acknowledging that any AI system reading text supplied by an opposing or external party is, by definition, reading adversarial input — and should be architected accordingly.

AiiN's takeaway

The detail worth remembering here isn't the legal drama — it's that a courtroom just became a real-world testbed for prompt injection with actual stakes attached. In our estimation, this case will likely push at least some court systems and legal AI vendors toward stricter input-sanitization requirements before AI-assisted review is trusted with more consequential steps. For anyone shipping AI into a workflow where the input isn't fully controlled, this is a preview of a problem that will keep showing up outside the courtroom too.