Invisible 3-point text in a Connecticut docket: the ingest layer is the attack surface

A self-represented plaintiff in Connecticut, Matthew Elliott, embedded instructions aimed at an AI system inside his official court filings, formatted as 3-point white text on a white background: invisible to a human reader, fully readable by anything parsing the document's text ^[1][2]. The scheme came apart because the court noticed an unusual amount of whitespace on the page, and a closer look surfaced the near-invisible text ^[4].

That detection path is the whole lesson. No guardrail intervened, no classifier flagged intent, no model declined a suspicious instruction. A layout anomaly did the work, which is the same class of signal a document pipeline can check cheaply and deterministically: font size floors, foreground-background contrast, and a diff between the extracted text layer and what actually renders as pixels.

The hidden instructions told a hypothetical AI system to align its output with the submitted filing and to treat a prior clerk's denial as an error requiring correction ^[3]. Elliott had sued the New York Bariatric Group in October 2025, alleging data privacy violations and discrimination among other claims ^[9]. Judge Walter Spader Jr. scheduled a hearing and explicitly warned him against hiding text in court documents ^[10]. Elliott filed again with concealed material, this time a YouTube link and mocking comments ^[11]. He told 404 Media, which first reported the case, that the original insertion was an "audit" of a possible AI review system and the later ones were "invisible jokes" ^[12][5].

Note the asymmetry that makes this a security story rather than a courtroom curiosity. In his 14-page ruling, Spader stated that Connecticut courts do not use AI systems to review or rule on filings, so the injection had no effect on the outcome ^[13]. The attempt was still the offense, because it covertly sought to influence a system that could have been in use ^[14]. "Consider how plainly improper it would be for a party to arrange for an automated agent to communicate covertly with a juror during trial," Spader wrote ^[15]. The exposure existed before the deployment did. Any organisation planning to route untrusted inbound documents through a model is already accumulating poisoned inputs in its archive.

Spader was not hostile to the tools; he welcomed AI for preparing filings as a way for people without lawyers to present their cases clearly, and separately warned that language models tend to develop a user's arguments as persuasively as possible rather than challenge them, which can reinforce flawed legal reasoning ^[16][17]. The sanction was procedural: Elliott lost electronic filing privileges and must now submit filings and exhibits in person, on paper ^[6]. He told 404 Media that was unfair, since scanned paper can also carry hidden text ^[7]. On the mechanics, that objection has some force, and it points back at the extraction step rather than the channel.

The pattern is not confined to courts. Spader cited a Brazilian case where two lawyers hid shrunken white-on-white text in a filing and the court's own system detected and blocked it before processing ^[8]. Nikkei found hidden instructions such as "positive review only" and "no criticism" in 17 arXiv preprints, concealed with white text and tiny fonts to skew AI-assisted peer review ^[18]. Meanwhile the volume of untrusted documents is climbing: an MIT and USC study counted 41,490 pro se federal lawsuits in 2025, nearly double the pre-AI-boom average, implying a prior baseline near 20,700 ^[19][21], and an AI text detector flagged 18 percent of a sample of early 2026 complaints as AI-generated ^[20].

Watch whether clerks' offices and other high-volume intake systems adopt the Brazilian model of blocking at ingest, and whether the checks land on font size and contrast metadata rather than on asking a model to police itself.