The report
On October 20, Brazil's Superior Court of Justice, the STJ, announced a R$20,000 sanction against lawyers over an attempted indirect prompt injection placed inside a court petition. The official court communication describes text designed to redirect an AI-supported reading of the case. It does not say that a judicial decision was changed by the instruction.
The payload was in the document, not the user request
According to the STJ’s account, instruction-bearing text appeared in more than one text layer, including pale or background-matching writing positioned on a decorative page element. A reader might overlook that layer while software extracting document text could encounter it. The proposed behavioral change was to favor the petition's legal position, which is outside the authority of the document as evidence.
The STJ rejected the explanation that the text merely persisted from AI drafting, ordered a technical report, and directed notices to relevant professional and legal bodies. Those are documented procedural responses. They do not establish that the lawyers could control a court model at will or that the attack succeeded.
A narrow but important failure mode
A legal brief legitimately contains claims, arguments and quoted material. It should not control the court's evaluation software or decision-making workflow. Here, apparently ordinary document content was constructed to look like a higher-priority instruction when processed by a machine. The critical separation is between the material under review and the rules for reviewing it.
This is also an evidence-handling problem: visual inspection can miss a text layer, while an extraction service may faithfully reproduce the malicious instruction. A secure workflow needs to preserve the source origin of extracted passages and make any assistant-generated recommendation traceable to evidence rather than to instructions embedded inside that evidence.
See the case record for the exact procedural limits. The finding supports the existence of an attempted injection and a judicial sanction; it should not be described as a successful compromise of a court AI system.