A self-represented plaintiff in Connecticut — pro se, in legal terms — hid invisible AI instructions in documents submitted to the court. The method Matthew Elliott used in his case against New York Bariatric Group was simple but effective: white text on a white background, set at 3 points.

What the text said

Nearly invisible to a human eye but perfectly readable by a language model, that text told a hypothetical AI system two things: to align its output with the filing being submitted, and to treat a clerk's earlier rejection as an error in need of correction.

The target, in other words, was not the human reading the document. The target was the software that might read it.

How it surfaced

What gave the manipulation away was not a technical check but a visible oddity: the court noticed an unusual amount of whitespace in Elliott's filings. On closer inspection, that whitespace turned out not to be empty at all — it carried nearly invisible text.

Judge Walter Spader Jr. held a hearing and explicitly warned Elliott about hiding text in documents. Elliott ignored the warning; his subsequent filings contained hidden messages again, including a YouTube link and sarcastic remarks.

The judge eventually likened the attempt to communicating secretly with a juror and revoked Elliott's electronic filing privileges.

Why it matters

The most striking aspect of the case is that the hidden instructions achieved nothing: Connecticut courts do not use AI to review filings. The attack was aimed at a system that does not exist.

But that is precisely where its importance lies. This is the plainest form of what is technically called prompt injection, and embedding it in a document requires no expertise whatsoever. Setting the font colour to white and shrinking the size is enough.

As institutions hand document review to AI, that attack surface widens. CV screening, insurance claim assessment, supplier bid comparison, academic peer review — the same opening exists in all of them. A similar case occurred in Brazil, where the court's own system detected the hidden text and blocked it.

Defending against it is not hard, but it has to be done

The frustrating part is that the defence is simple and still missing in most places. Stripping invisible content while extracting text from a document is a few lines of work:

  • Flag or discard text set in the same colour as its background.
  • Move text below a certain point size into a separate layer.
  • Clean out elements at zero opacity or sitting on an invisible layer.
  • Compare whether the extracted text matches the text a human would read visually.

Elliott's attempt produced no result, but it did pose a question: when an institution has AI read its documents, who checks that those documents say the same thing a human sees?

The judge's analogy also shows how seriously this is taken. Communicating secretly with a juror counts among the gravest violations in a judicial process; by placing the hidden instruction in that category, the judge is saying this is not technical cleverness but a procedural breach.

That assessment matters because no rule yet describes this behaviour directly. Rather than invent a new category, courts are applying existing principles: a concealed communication attempting to influence a decision is prohibited regardless of the technology used to carry it.