Topic starter
27/10/2026 7:12 pm
TL;DR: A Brazilian labor court fined two lawyers after a filing hidden with prompt-injection text tried to steer an AI review system toward a superficial response, according to JetStream Security, showing that machine-readable submissions now carry governance risk alongside the visible document.
Editorial analysis by NHI Mgmt Group, based on content published by JetStream Security: “Brazilian Court Sanctions Lawyers for Prompt Injection in Court Filing”.
By the numbers:
- The court fined the two law firms 10% of the claim’s value.
Key questions
Q: What breaks when prompt injection is hidden inside a document instead of a chat prompt?
A: The control boundary breaks because the system treats untrusted document text as if it were legitimate input.
Q: Why do AI review systems need governance controls for uploaded documents?
A: Because the risk is not only prompt text typed into a chat box.
Q: What are the signs that a document may contain prompt injection?
A: Warning signs include hidden text, strange colour contrasts, unexpected font layering, unusual OCR output, and instructions that speak to the AI rather than the document’s subject.
Practitioner guidance
- Define hostile-document screening Scan inbound filings and uploads for hidden text, colour-based concealment, OCR anomalies, and other formatting tricks before AI review processes them.
- Separate task instructions from source content Ensure the system prompt, workflow instructions, and document text are isolated so untrusted documents cannot override review behaviour.
- Add human approval for suspicious submissions Route documents with unusual formatting, embedded commands, or provenance gaps to a manual review queue before any automated summarisation or decision support.
Bottom line: The case shows that prompt injection can be embedded inside ordinary documents and still affect an AI review workflow.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →