A Connecticut judge caught a litigant hiding instructions for AI inside a court filing. While most of the media coverage stopped at the white font the plaintiff used, there’s a deeper and more useful lesson about how lawyers prompt.

Writing for Texas Lawyer, Joe Stephens, JD, Steno’s Director of Legal Solutions, looks at Elliott v. New York Bariatric Group. In that 14-page ruling, Judge Walter M. Spader Jr. appears to have issued the first U.S. sanction for prompt injection in a court filing. Matthew Elliott, a self-represented plaintiff, embedded three-point white text in his motions telling any large language model to agree with his arguments. It surfaced only because the judge printed the filings and noticed unexplained white space.

Joe credits the court for both its restraint and its reasoning. Rather than dismissing the suit, the judge revoked Elliott’s electronic filing privileges and confirmed he could keep using AI for research as long as he verified the output. And by treating prompt injection as a form of ex parte communication, Judge Spader gave the misconduct a home in settled law. Joe explains why the framing holds up:

An AI tool reads its operator’s instructions and a document’s contents as a single, undivided stream of text, with no boundary separating the two. A hidden command therefore smuggles the filer’s argument into the machine as though it came from the court, a clerk, or opposing counsel, and the other side never gets the chance to see it or answer it.

Then Joe turns to what he says gets far less attention: the confirmation trap. Language models respond to the framing they’re given, and as Joe puts it, the problem is not that the model fails to follow instructions, but that it follows them too well. Ask one to build the case for your position, and it will.

By demanding that a tool validate a thesis rather than stress-test it, a practitioner strips away the software’s primary analytical utility. That process trains the assistant to provide comfortable answers, creating a false sense of confidence that collapses the moment a hearing begins before a judge who has evaluated both sides of the issue.

His answer is to flip the script. Instead of asking AI to act as co-counsel, ask it to act as opposing counsel or a skeptical bench, and let it find the weak factual assumptions, missing elements, and unaddressed precedent before a judge does.

Read the full piece in Texas Lawyer.