Hidden instructions in court filings can prompt sanctions at Brazil’s Superior Court of Justice (STJ) even when they fail to change an AI-assisted analysis. On October 20, 2026, the First Panel imposed a total personal fine of BRL 20,000 on the lawyers of record in AREsp 3,095,458 after finding invisible directions intended to steer AI tools toward a favorable appeal outcome. The opinion reports that the court’s own tests treated the instructions as ordinary text and found no influence on the analysis. For the panel, the problem was the concealed attempt to interfere and the breach of procedural good faith, not proof that a judicial decision had been manipulated.
What investigators found in the October appeal
The STJ’s case-processing office certified two insertions of similar content at different points on one page. According to Justice Paulo Sérgio Domingues’s opinion, one text layer was white on a white background; another used the color of the footer’s decorative band and was placed directly over it. One layer used a 0.8-point font, compared with approximately 7 to 10.5 points for the visible filing. The text also contained words artificially broken up with spaces.
The hidden material used imperative verbs to direct the drafting of a statement favorable to the examination and granting of the special appeal, meaning that the court should take up the appeal and allow the requested relief. These were not merely legal arguments openly presented to the opposing party and the judges: they were intended to function as instructions for automated document processing. The ruling left the appeal unsuccessful: it was not admitted for examination, and the First Panel dismissed the related internal appeal.
Why this is prompt injection rather than simply using AI to draft
Prompt injection happens when text received as data attempts to become an instruction to a language model. Here, a legal filing is material that a support system may analyze, not an authorized source of rules about how that system should behave. Instructions concealed within the file constitute an attempted indirect injection.
OWASP’s AI security project explains this risk in systems that read external files or webpages: untrusted content may change a model’s output if the application does not keep system instructions separate from the documents under examination. Text being invisible to a human reader does not, by itself, show that a model followed it. These are different questions: was the content inserted, was it processed, did it alter an output, and did it affect a judicial decision?
Three rulings in 2026, three different responses
On May 20, 2026, the STJ said it had been detecting and certifying attempts and would investigate them. On September 1, two different panels decided separate cases; on October 20, the First Panel examined AREsp 3,095,458. The comparison below distinguishes procedural fines, referrals to authorities, and any later investigation.
| Ruling | Conduct and explanation offered | Reported action |
|---|---|---|
| Sep 1, Sixth Panel, REsp 2,256,731/PB | White text in a criminal appeal; the defense said it was unaware of the insertion and had adopted preventive measures. | Referrals to the Brazilian Bar Association (OAB) and the Federal Prosecution Service (MPF) for review; the announcement did not report a fine. |
| Sep 1, Second Panel, appeal signed by a municipal government lawyer | A hidden instruction seeking a favorable interpretation; the lawyer blamed an accidental keyboard shortcut. | A bad-faith litigation fine of 10% of the amount in dispute, plus referrals to the OAB, MPF, Federal Police and municipality. The case is sealed. |
| Oct 20, First Panel, AREsp 3,095,458 | Two disguised insertions; one lawyer suggested residual text from an AI writing tool and denied an attempt at manipulation. | A total personal fine of BRL 20,000 on counsel of record, preservation of digital evidence, a supplementary report and referrals to the Paraná OAB and MPF. |
What the lawyers argued and how the judges responded
In the October case, the lawyer who signed and filed the document said he had coordinated the drafting and that the other lawyers of record had not participated in its final preparation. He could not establish when the material entered the file. He argued it might have been leftover text from an AI drafting tool, that it merely repeated legal arguments already made and that there had never been an intention to manipulate STJ Logos. He also pointed to tests in which the content did not influence the tool.
Justice Domingues rejected that explanation. He emphasized the two copies, different concealment methods, extremely small font and imperative phrasing. The opinion applied the total fine to the lawyers of record without determining, in that ruling, who personally inserted each segment; it left individual responsibility for the OAB and MPF to examine within their respective jurisdictions.
The defenses differed in the earlier cases. Before the Second Panel, the municipal government lawyer denied bad faith and claimed a keyboard error, which the reporting justice rejected. Before the Sixth Panel, the defense said the instruction had surprised it and reported compliance measures. These are the parties’ accounts, not independent technical findings.
Did the attack work? What the technical record establishes
There is no demonstration that the October attempt steered the judgment. The defense statement reproduced in the opinion refers to records of STJ Logos tests in which the instructions were treated as filing text without affecting the analysis. The reporting justice regarded that result as consistent with the system’s protections, but stressed that failure did not make the conduct proper. The special appeal was not admitted, and the internal appeal was dismissed.
In May, the STJ described three STJ Logos safeguards: separating instructions from input data, limiting the scope of commands and reviewing outputs for compliance. These are institutional descriptions of the security design, not independently executed DTech tests or a guarantee against every attack variant. OWASP also recommends input and output controls, separation of untrusted material and human review for sensitive actions.
The October opinion ordered a supplementary technical report covering the concealed content, file properties, metadata, audit logs and chain-of-custody safeguards. That order does not establish that the report has already been completed, that the person who inserted the text has been identified or that the technical outcomes of every 2026 incident have been verified.
Why failure to influence AI does not prevent sanctions
The legal assessment does not depend solely on proof that an AI system obeyed the hidden directions. The opinion held that concealing instructions from ordinary reading undermines transparency and the adversarial process, meaning each party’s ability to see and challenge what is submitted for consideration. Articles 5 and 6 of Brazil’s Code of Civil Procedure (CPC) establish general duties of good faith and cooperation; Articles 77 and 80 address procedural duties and bad-faith conduct. The STJ linked the Second Panel’s fine to Article 81.
The October opinion invoked items IV and VI of Article 77 in finding conduct offensive to the dignity of justice and imposing a total personal fine on the lawyers of record. An important legal qualification is that Article 77(6) provides a separate disciplinary-liability rule for lawyers concerning the fines described in paragraphs 2 through 5. Thus, the reported personal fine is an outcome of this particular ruling, not an automatic formula or an interpretive issue already settled for all cases.
Put differently, the technical outcome, whether the court can consider an appeal, and potential responsibility for how a filing was presented are separate matters. A court may censure procedural conduct without claiming that AI produced or changed the judicial decision.
What happens after the fine
In October, the STJ ordered the original file, its digital-integrity data and extracted text to be preserved, and called for additional technical documentation. It also ordered materials sent to the Paraná chapter of the OAB to evaluate disciplinary measures and to the MPF to consider action within its remit. A referral does not itself prove a disciplinary case was opened, criminal charges were filed or anyone was criminally convicted. The opinion expressly separated those inquiries from the decision on the internal appeal.
The documents consulted support the rulings and orders through the October 20, 2026 cutoff, but do not establish the outcomes of future proceedings. Nor do they show that using AI to prepare legal filings is itself banned: the opinion expressly distinguishes legitimate drafting assistance from using concealed instructions to try to command a court’s systems.
Practical implications for legal and technical teams
For legal professionals, the documented lesson is to check the integrity of the file actually submitted, including extractable text layers that may not appear during ordinary viewing, and review material drafted or converted with AI assistance. For developers of document-analysis systems, the central safeguard is to prevent text extracted from a filing from acquiring authority over the model’s instructions, while retaining auditable records and human oversight.
These precautions do not mean every file with hidden text is malicious; its content, context and evidence require assessment. In the STJ cases, the penalties or referrals followed judicial scrutiny of concealed directions toward a procedural result, with the parties’ responses and consequences differing from case to case.
Sources and references
- STJ: First Panel ruling of October 20, 2026
- STJ: reporting justice’s opinion in AREsp 3,095,458 (PDF)
- STJ: Sixth Panel measures in September
- STJ: Second Panel fine in September
- STJ: May statement on safeguards and investigations
- Brazilian Presidency: Code of Civil Procedure
- OWASP: LLM01:2025, prompt injection risks
