Galileu Prompt Injection: Brazilian Court Fines Lawyers Over Hidden Filing Text

Galileu prompt injection brought sanctions against two Brazilian lawyers after a labor court found concealed instructions inside their filing. Prompt injection means embedding instructions in material an AI processes to redirect its behavior. In this case, white text on a white background concealed the material from ordinary human viewing. The court treated the insertion as attempted interference with judicial work.

The ruling came from the Third Labor Court of Parauapebas, in Brazil’s Pará state, on May 12, 2026. That timing matters: November coverage concerns an earlier decision, rather than a newly discovered filing. The finding also needs a careful boundary. An attempted manipulation does not establish that an AI followed it or that it changed a judgment.

The central conflict pits document automation against the obligation to treat adversarial submissions as evidence requiring scrutiny. Microsoft and Anthropic address this same boundary in their security guidance. Courts face an especially demanding version: opposing parties legitimately submit persuasive documents, while judges must distinguish those arguments from concealed attempts to control software.

What the Galileu prompt injection ruling actually established

The labor court ruling describes hidden text discovered while processing the initial complaint through Galileu. Changing the font color exposed the material.

The judge attributed responsibility to the two lawyers who signed the complaint. The decision imposed a joint fine equal to 10% of the claim’s value and ordered notifications to professional and judicial oversight bodies.

The documented finding concerns an attempted manipulation, without establishing a successful takeover of the court’s AI.

That distinction prevents the story from becoming larger than its evidence. Discovery, attempted influence, successful influence, and a changed judicial outcome represent separate claims. Establishing one does not automatically establish the others.

The concealment also changes how readers should understand the filing. Lawyers routinely ask courts to accept their interpretation of facts and law. A hidden instruction aimed at software operates through a different channel.

The court’s reasoning places responsibility on the professionals who prepared and signed the submission. That finding should remain attributed to the judge. It does not give outside observers independent knowledge of every step involved in creating the document.

The underlying labor dispute and the sanction also require separate treatment. A party’s entitlement to employment-related relief does not determine whether its representatives handled a filing properly. Equally, misconduct involving a document does not automatically settle the merits of every underlying allegation.

This separation matters when a technology story enters legal reporting. A dramatic account of an AI attack can obscure the narrower procedural action a judge actually took. Readers need both the technical allegation and the limits of the judicial finding.

The accessible decision provides evidence beyond a circulating social post. It supports reporting the incident as a documented court action. It does not eliminate questions about subsequent proceedings, challenges to the sanction, or disciplinary outcomes.

A referral to a bar association starts a separate accountability process. It should not be described as a completed disciplinary judgment. The same caution applies to any assumption that the original fine necessarily remained unchanged.

The clearest account therefore holds several points together. The court identified concealed material, attributed responsibility, and imposed sanctions. Claims about final disciplinary consequences or broader technical success need their own evidence.

For readers outside Brazil, the lasting significance lies in that evidentiary discipline. A suspicious filing can trigger consequences even when reporting does not establish that its intended manipulation succeeded.

Court automation puts the document boundary under pressure

Galileu was designed for work directly adjacent to judicial reasoning. Brazil’s National Council of Justice described its judicial drafting role in May 2025.

According to that account, the system reads initial petitions and defenses, organizes information, and suggests draft material for judges. Developed by TRT-4, it received authorization for use across Brazil’s labor courts.

A drafting assistant needs protection before its output reaches the person responsible for the decision.

The institutional promise is understandable. Organizing allegations and responses can reduce repetitive work. A structured draft can help a reviewer navigate a complicated record.

The security question begins with the same material that makes the assistant useful. Parties supply the documents, while the court controls the task. Those roles must remain distinct throughout processing.

A filing has authority as a submission within a case. That status does not grant its author authority over the court’s software. Accepting a document for consideration should never mean accepting embedded directions about how the assistant must operate.

This creates pressure on several groups. Judges need confidence that draft material reflects the record. Court staff need a dependable way to escalate suspicious content without losing legitimate evidence.

Developers face a different obligation. They must preserve the distinction between a document’s statements and the application’s instructions. A fluent response cannot show whether that distinction survived.

Procurement teams also need more than a demonstration involving clean sample documents. The relevant question concerns performance when a submission contains conflicting, concealed, or misleading material. Ordinary accuracy testing leaves that question unanswered.

Human supervision remains essential, but its placement matters. Reviewing a polished draft after processing creates a different opportunity for scrutiny than inspecting suspicious source material before generation.

A reviewer might notice a strange sentence in an output. Detecting a missing argument presents a harder task because the omission leaves no obvious warning. This is an analytical risk, rather than a finding about this particular case.

The pressure therefore extends beyond whether a judge signs the final decision. It concerns whether the workflow gives that judge a meaningful opportunity to inspect the information shaping the draft.

For enterprise buyers, the comparison is immediate. A contract review assistant and a court drafting assistant serve different institutions, but both process documents written by outsiders.

An AI knowledge base raises a related question when it incorporates external material. Searchability and convenient retrieval do not determine whether a source should influence an assistant’s behavior.

The deployment lesson is specific: useful document access increases the importance of controlling what authority those documents receive. The benefit and the exposure arrive through the same intake channel.

The attack targeted authority, not just text visibility

White text attracts attention because it resembles invisible ink. The deeper issue concerns a trust boundary, meaning the separation between material an application reads and instructions it accepts.

Concealment explains why a person might miss the material; authority confusion explains why the material matters to an AI workflow.

A document can contain text that ordinary viewing makes difficult to notice. Depending on the processing method, software can still encounter that text. Human appearance and machine input therefore deserve separate examination.

The Galileu prompt injection case illustrates why visual inspection alone cannot answer every security question. A normal-looking page does not necessarily reveal everything supplied to a text-processing system.

The reverse also matters. Finding unusual text does not establish that a model obeyed it. A security assessment must distinguish the presence of an attempted instruction from evidence about its effect.

In a court workflow, an outside party should control its own allegations and supporting materials. It should not control the assistant’s standards for evaluating those materials.

That distinction remains necessary even when the document uses formal legal language. Professional formatting, signatures, and procedural acceptance establish context. They do not turn every sentence into an authorized software instruction.

The same reasoning explains why a rule against white text would be incomplete. Presentation is only one aspect of the problem. The governing question concerns whether outside content can redirect the application.

This is where the incident connects with commercial AI security work. Microsoft’s document attack controls distinguish attacks inside documents from attacks submitted directly by a user.

Microsoft says its Prompt Shields analyze supplied material for manipulation patterns. Its documentation also distinguishes detection from blocking: application configuration and integration determine what happens after a suspicious result.

That difference is operationally important. An alert is evidence that a component noticed something. It does not, by itself, show that every downstream component stopped using the suspicious material.

Anthropic’s untrusted content guidance approaches the boundary through input screening and explicit separation of third-party content from application instructions.

The company recommends making the source and nature of retrieved material clear. Those recommendations describe a defensive approach; they do not establish how Galileu was configured when this filing was processed.

Neither vendor’s documentation supports declaring a universal winner in legal AI security. Different applications expose different documents, permissions, and review stages. A product name alone cannot establish the safety of a particular deployment.

The useful comparison concerns responsibility across the workflow. Screening, restricting authority, reviewing outputs, and escalating incidents address different failure points. Evaluating only the underlying language model leaves those application choices unexamined.

The Brazilian incident makes this issue concrete. The important boundary lies between considering a party’s submission and allowing that submission to define how the assistant performs its task.

The lawyers disputed the purpose of the hidden prompt

The account also includes a contested explanation. According to JOTA’s reporting on the lawyers’ stated defense, the lawyers acknowledged using a hidden prompt.

They disputed that they were attempting manipulation and described their purpose as protecting their client from the AI. That position differs from the judge’s characterization of the conduct.

Concern about judicial AI deserves scrutiny, but it does not resolve the dispute over a concealed intervention.

The distinction matters because criticism of court automation can be legitimate. Parties have an understandable interest in knowing how their submissions are processed and whether automated assistance affects their treatment.

That interest creates questions about transparency, accuracy, and meaningful review. It does not automatically establish that a hidden intervention constitutes an acceptable way to raise those concerns.

The court’s position and the lawyers’ explanation should therefore appear together. Readers should see the disagreement without treating either account as an independently established description of motive.

An admission about inserting material also differs from an admission about its intended legal or technical effect. Reporting should preserve that difference rather than compressing the dispute into a simple confession.

The strongest skeptical reading of the technology story concerns what remains unseen. Publicly available findings describe the suspicious content and the sanction. They do not provide a complete reconstruction of every model interaction.

Without that reconstruction, observers cannot confidently measure how the material affected intermediate summaries, whether any processing stage rejected it, or how alternative configurations would behave.

A detected attempt supports a limited positive conclusion: this incident reached human attention. It does not establish a general detection rate across other documents or future attacks.

The inverse overstatement would also be misleading. The existence of an attempted attack does not show that the entire platform failed. A system can encounter hostile input while its surrounding controls help contain the incident.

This uncertainty creates a demanding standard for both supporters and critics. Supporters need evidence before presenting detection as comprehensive protection. Critics need evidence before claiming that the hidden text controlled the judgment.

There is also a procedural uncertainty. The original decision and a report about the lawyers’ response cannot establish the final status of every challenge or referral.

Readers should look for later court orders and disciplinary decisions before drawing conclusions about lasting sanctions. A referral, an initial ruling, and a final professional outcome remain different events.

That leaves a clear, bounded finding. The court treated the hidden material as attempted interference, while the lawyers reportedly disputed its purpose. Broader conclusions require evidence beyond that disagreement.

A caught attempt leaves a larger accountability test

The Galileu prompt injection story puts accountability at the point where legal responsibility meets software behavior. A court can assign responsibility for a filing while technical questions remain unresolved.

Sanctioning the author and securing the processing system address separate obligations.

The professional obligation concerns what a representative submits. The institutional obligation concerns how the court handles material it cannot assume is benign. Neither obligation disappears because the other receives attention.

A fine creates consequences for conduct attributed to the submitting professionals. It does not explain whether every future document will receive equivalent screening. That requires evidence about the system and its operation.

Technical controls face an equally important limit. Even effective detection does not decide every question of professional responsibility, intent, or appropriate procedure. Those remain matters for authorized decision-makers.

The practical challenge is maintaining a record that connects the two processes. If suspicious content triggers a referral, the institution needs enough information to explain what was found and why it mattered.

For an affected party, a vague statement that an AI noticed something would provide little opportunity for scrutiny. A reviewable account should distinguish the source document, the detection, and any resulting action.

This requirement also protects the court’s own analysis. A clear record reduces the temptation to infer technical success solely from the presence of suspicious material.

The same principle applies to product claims. A vendor demonstration can show a successful response to a selected example. It cannot establish performance across every document style or adversarial strategy.

Buyers should therefore distinguish evidence of capability from evidence of dependable operation. The former shows that a control can work. The latter requires observing how it behaves under the deployment’s actual conditions.

False positives, meaning ordinary material incorrectly flagged as suspicious, deserve attention alongside missed attacks. Legal documents sometimes discuss disputed language or quote material for evidentiary reasons.

An intake process must preserve the ability to examine that content without granting it operational authority. Automatically treating every unusual passage as misconduct would create its own fairness problem.

This is an analytical requirement for trustworthy processing, rather than an allegation about Galileu’s handling of legitimate documents. It follows from the need to evaluate evidence without allowing evidence to direct the evaluator.

For knowledge workers, the broader implication concerns the status of retrieved information. A passage can be relevant to a question while remaining untrusted as an instruction.

For developers, the implication concerns what they promise users. A claim that a tool handles documents should come with evidence about conflicting content, escalation, and review.

For institutions, the implication concerns ownership. Someone must remain responsible for deciding whether suspicious material proceeds, stops, or receives further examination. Leaving that responsibility implicit makes both incidents and ordinary errors harder to investigate.

The case therefore offers a concrete accountability test. Can the institution explain the document’s path through the system well enough to support scrutiny of both human conduct and automated processing?

What to watch after the hidden-text ruling

Brazil’s National Council of Justice approved guidance addressing concealed commands in judicial AI systems on June 9, 2026. Its published explanation links the initiative to preserving legal certainty.

The judicial security guidance shows that the institutional response extends beyond an individual filing. Implementation remains the issue readers should examine next.

The next useful evidence concerns reviewable outcomes, tested controls, and changes inside document intake.

The first signal is the subsequent procedural record. Over the coming months, watch for accessible decisions addressing challenges to the original sanction or the outcome of professional referrals.

Those records would clarify the durability and scope of the court’s response. A decision affirming the sanction would strengthen its value as an accountability example.

A decision narrowing or overturning it would require a more qualified account. Either development would improve the evidence available beyond the initial ruling and public explanations.

The second signal is technical evaluation tied to the deployed workflow. Useful disclosures would identify what was tested, what the system detected, and what happened afterward.

Detection results need context. Readers should look for whether suspicious content stopped before generation, reached a reviewer, or remained available to downstream processing.

Tests should also include legitimate documents that resemble attacks. Otherwise, a system might appear effective while creating unnecessary barriers to ordinary submissions.

Evidence across both malicious and benign material would strengthen confidence in the controls. A publicity statement describing only a selected success would leave the broader reliability question open.

The third signal is visible implementation of institutional guidance. Watch for documented intake changes, assigned review responsibilities, and procedures for preserving evidence when suspicious material appears.

Such changes would strengthen the argument that courts are treating this as a continuing operational issue. Guidance without a clear implementation record would provide less support for that conclusion.

None of these signals requires predicting a scheduled announcement. They are evidence to seek between November 2026 and early 2027, rather than events already promised.

Together, they would help separate a memorable incident from a durable response. The important measure is whether institutions can repeatedly identify problems, explain their actions, and preserve fair review.

For anyone evaluating document AI, use this case to ask a concrete question: what happens when source material tries to direct the assistant? Ask for evidence showing what the application reads, what authority it assigns, and where human review enters. Look for an explanation that distinguishes detection from prevention and an attempted manipulation from a changed result. The Galileu prompt injection incident warrants that level of precision because its significance rests on a boundary every document assistant must maintain. Before trusting a summary that supports a consequential decision, examine whether the workflow can show how it handled conflicting material and who remains responsible for the result.