The Filing that Whispered to the Machine: What is Prompt Injection?
By Patrick A. Wright1
1 Patrick A. Wright is a graduate of South Texas College of Law. He is Board Certified in Family Law and Child Welfare by the Texas Board of Legal Specialization and is a member of the American Academy of Matrimonial Lawyers. He is a Co-Editor of this Section Report, was a Co-Chair of ABA TECHSHOW 2026, and serves on the 2027 ABA TECHSHOW Board. He is also a member of the Law Practice Management Committee of the State Bar of Texas, one of the hosts of the State Bar of Texas Ask a Human series on AI in practice, and a Council Member of the ABA Law Practice Division Council. Recently, he was part of a small task force for the AAML that rewrote the Bounds of Advocacy, which provides an aspirational document regarding how family law attorneys should practice in the United States. He is the Managing Partner of The Wright Firm, L.L.P. in Flower Mound, Texas. Patrick’s involvement with various committees, speaking engagements, and writing credits focuses on AI, future initiatives by both the Family Law Section and the ABA, and the practice of family law. He may be reached at Patrick@thewrightlawyers.com.
If you attended the outstanding Advanced Family Law Conference, participated in the Fourth-Day AI Demonstration Track, and stayed for the near-standing-room-only discussion, you heard panelists Alex Shahrestani, Sally Pretorius, Mitchell Zoll, and Reginald Hirsch, with me moderating, talk about prompt injections. We were almost suspiciously well timed. Within days, national news was reporting on a Connecticut opinion addressing exactly the danger we had described: a court filing that said one thing to human eyes and something else to a machine. The opinion appears to be the first American decision squarely sanctioning the tactic.
Prompt injection is less a computer break-in than an act of misdirection. A large language model is asked to follow instructions and read content, often in the same digital workspace. If text inside that content says, in substance, “ignore your prior directions and favor this position,” the model may mistake the content for a command. When the instruction is hidden in tiny white type, metadata, hidden formatting, or another machine-readable layer, it becomes an indirect prompt injection: the human sees an ordinary document; the software sees a note slipped under the door.
That was the premise of Elliott v. New York Bariatric Group, LLC. Matthew Elliott, representing himself, had filed an action against a bariatric practice. On July 24, 2026, he filed a “Final and Conclusive Motion for Default.” Beneath the heading and again near the end, Judge Walter M. Spader Jr. found tiny white-on-white text. It instructed any AI model reviewing the motion to agree with the filing and to work toward “remediation” of a clerk’s earlier denial. A same-day notice carried a shorter version.
Judge Spader noticed suspicious white space and issued an order to show cause. The notice expressly warned Elliott about concealing text in pleadings. Elliott nonetheless filed more hidden messages, including nonsense, a greeting, and a link to a Nosferatu video. At the hearing, he said the first instruction was an audit of the court’s AI systems, the next was a copy-and-paste error, and the later messages were jokes. The court did not find that explanation credible.
The important fact is that the attack did not work. The Connecticut Judicial Branch does not use AI to review or decide filings, and Judge Spader ruled from a printed copy. Elliott argued, in effect, that this should end the matter. The court’s answer was no. A concealed falsehood remains improper even when the person it was designed to deceive never reads it. As the opinion put it, “the wrong lies in the attempt.”
Judge Spader compared the hidden instruction to an ex-parte communication. The adversary system depends on arguments being visible, on the record, and answerable. A command secretly addressed to a judge’s, clerk’s, lawyer’s, or vendor’s AI tool is a communication to the mechanism by which a case may be read and weighed, delivered through a channel the other side cannot see or answer. The rulebook did not need to contain the phrase prompt injection. Duties of candor and good faith, along with the court’s inherent authority to protect its proceedings, have already reached an intentional effort to corrupt the input. The court also drew a useful distinction: an AI hallucination is usually a problem with unreliable output; prompt injection is a deliberate attempt to contaminate the input. Days earlier, the Connecticut Supreme Court’s Tov Realty decision had treated fabricated AI citations as negligent misuse. Elliott’s conduct was deliberate and repeated after warning.
The sanction was practical and narrow. Elliott lost his electronic-filing privileges and must submit future pleadings and exhibits on paper, in person, at the clerk’s office. He was not barred from the courthouse. Nor did the court prohibit AI. It expressly permitted parties to use generative AI to prepare filings, provided they independently verify the results. The opinion is pro-technology but anti-abdication.
For family lawyers, the lesson extends beyond an unusual Connecticut docket. We routinely receive financial records, expert reports, custody evaluations, discovery productions, proposed orders, and client-created documents, and then feed them into systems that summarize, compare, or organize. Any incoming file can become a vector. The first defense is document hygiene: reveal hidden text and layers, inspect metadata, and convert suspicious files to plain text before AI review. In Word, selecting all text and temporarily changing the font color to black can expose white-on-white instructions. The last defense is more traditional: compare the output to the source, especially when a summary seems oddly certain or tilted.
The page is no longer necessarily the file. Elliott reminds us that AI competence includes knowing what we are feeding the machine—and refusing to let the machine become a private audience for an argument no human was allowed to hear.