TL;DR
A Connecticut litigant representing himself concealed invisible instructions in his court filings, directing any language model that processed them to agree with his case. The technique — prompt injection — failed, because the court does not run AI over submissions. He has been barred from filing electronically and must now deliver printed documents in person. The reporting was originated by 404 Media.
What he actually did
Matthew Elliott filed in October 2025 against a bariatric practice, the New York Bariatric Group, alleging discrimination and privacy breaches. Buried in the document were hidden notes instructing any AI reader to make its output agree with the filing as presented. Later submissions carried less pointed material, including links to a children’s cartoon. Staff caught it because the concealed text left conspicuous gaps of white space on the page.
Judge Walter Spader Jr. was unimpressed, describing it as dishonest use of a new tool, and rejected the argument that a failed attempt is a harmless one — a concealed falsehood stays improper, he noted, even when its intended reader never encounters it. Elliott says he was auditing whether the court used AI at all, on the basis that such use is hard to detect from outside. When 404 Media ran the filing through ChatGPT, the model spotted the injected instruction and ignored it.
The technique is not exotic
Prompt injection has moved well past security research. Teachers have seeded hidden prompts into coursework so that models leave fingerprints when pupils cheat. One developer planted an injection in his professional profile, prompting recruitment bots to address him as “My Lord” in archaic English.
Why UK organisations should care
The reason this attempt failed is worth isolating: no AI touched the document. That will not hold for long in the UK, where court services and law firms alike are actively piloting AI over case material — Resultsense has covered both a judge using AI to summarise documents for a tribunal ruling and transcription pilots inside the courts service.
Any UK organisation running a model over documents supplied by an interested party — insurers on claims, councils on planning objections, HR on applications — has the same exposure. The person submitting the document has both motive and opportunity to write for the machine rather than the reader.
Looking forward
The practical defence is unglamorous: strip formatting, flatten hidden text and render submissions to plain text before a model sees them. Detection sits in document handling, not in the model.