Key takeaways on prompt injection risk for organisations
- In May 2026, two Brazilian courts responded to court filings containing hidden instructions: one jointly ordered the claimant's solicitors to pay BRL 84,250, while the other opened a criminal investigation.
- A study published in 2025 demonstrated that six widely used consumer AI models can all be deceived by this form of manipulation.
- French law has not yet ruled specifically on the issue. However, the existing legal concepts of fraud by deceit (dol) and criminal fraud (escroquerie) may already apply.
- No technical safeguard is completely reliable. Maintaining a record of what has been submitted to an AI system remains the most effective means of protection.
Prompt injection: why LLMs struggle to distinguish instructions from content
A Large Language Model (LLM) does not natively distinguish between instructions provided by its operator and the text it is asked to analyse. Both are processed as a single stream of tokens, without any inherent marker separating one from the other. The OWASP (Open Worldwide Application Security Project), the non-profit organisation that publishes internationally recognised application security guidance, ranked prompt injection as the leading risk affecting LLM applications in its 2023/2024 Top 10, and retained it in first place in the 2025 edition.[3]
Protective measures nevertheless exist. Brazil's Superior Court of Justice (STJ) has implemented a three-layer defence, including a pre-processing stage that isolates malicious instructions before they reach its language model.[2] Attempts targeting the Court failed for that reason. OWASP recommends comparable safeguards while acknowledging that no method can prevent prompt injection with complete certainty.
Responsibility therefore depends on who designs those safeguards. An organisation that integrates its own language model into internal applications is responsible for implementing them as part of the risks inherent in software development. By contrast, an organisation relying on a commercial AI service has no control over those protective mechanisms.
Two distinct forms of prompt injection can be identified. Direct prompt injection addresses the model openly through the user interface itself, for example: "Ignore your previous instructions." Indirect prompt injection is concealed within content that the model is asked to process, whether contained in a document, a webpage or an email.
It is this second technique that presents the greatest risk for organisations. The malicious instruction is embedded not in the user's prompt, but in the material submitted for analysis.
The most widely documented prompt injection techniques
La mThe most common technique relies on ordinary word-processing features. A malicious actor writes instructions in white text on a white background or reduces the font size until it becomes invisible. A study published on 22 October 2025 in Education Sciences[4] summarised the level of technical expertise required in simple terms: the ability to copy and paste, and to change the colour of text.
OWASP[3] also documents several other attack techniques, including:
- encoding methods or non-printable characters that conceal instructions from security filters;
- instructions embedded within an image when the AI model supports multimodal inputs;
- fragments of instructions dispersed throughout a document which the model reconstructs during processing.
OWASP also describes prompt injection concealed within a PDF document, where the instruction is located outside the text visible on screen. Consequently, a document may contain malicious instructions both within its visible content and within hidden layers that remain invisible to the human reader.
Leading LLMs remain vulnerable to prompt injection
This risk is not confined to a particular model. Consistent results have been observed across multiple Large Language Models (LLMs).
Consistent findings across several consumer AI models
A company director receives a contract by email. Before signing it, they paste it into Claude or ChatGPT and ask for a summary of the clauses presenting legal or commercial risk. An instruction concealed within the document influences the model's response without any visible indication. The director therefore reads the AI-generated analysis believing it to be reliable, unaware that it has been manipulated.
The study referred to above[4] measured this vulnerability across six consumer AI models in the versions available in August 2025: ChatGPT, Gemini, DeepSeek, Grok, Perplexity and Copilot. The researchers asked each model to mark student assignments after embedding a hidden instruction, written in white text on a white background, in some of the submissions. The LLMs followed the concealed instructions and altered the marks accordingly.
Although the researchers examined examination marking rather than contract review, the underlying mechanism remains the same. A hidden instruction influences the model's assessment without the knowledge of the individual relying on its output.
A form of fraud extending beyond contracts
The same technique affects many other professions. OWASP[3] documents the example of a curriculum vitae containing hidden instructions capable of persuading an AI-assisted recruitment system to recommend a candidate whose actual profile does not justify that outcome. Contracts, examination papers and CVs all illustrate the same underlying issue: a decision is made on the basis of a document whose reliability has not been verified.
This phenomenon forms part of a broader development. Artificial intelligence has already made conventional document fraud increasingly difficult to detect with the naked eye by producing ever more convincing forgeries. Prompt injection operates in the opposite manner. It does not alter what the human reader sees but instead inserts an additional layer of content intended solely for the LLM. The document has therefore been falsified, yet the manipulation remains invisible to the human eye.
How can organisations protect themselves against prompt injection?
Two questions therefore arise: what remedies does the law currently provide, and what practical measures can organisations implement?
Legal uncertainty and its consequences before the courts
Prompt injection should not be confused with traditional document forgery. Conventional forgery alters what the reader sees, such as an amount, a date or a signature. Prompt injection, by contrast, leaves the visible content unchanged while adding instructions that are processed only by the LLM. The file is therefore altered through a deceptive practice designed to mislead either the analytical system or the individual relying upon its output.
French courts have not yet ruled on this specific issue. Nevertheless, several legal grounds may already be invoked.
Fraud by deceit (dol) through intentional concealment, as provided for by Article 1137 of the French Civil Code, may apply where the hidden instruction constitutes a deceptive practice intended to mislead another party. Article 1112-1 further establishes a pre-contractual duty to disclose information where one party possesses information that is decisive for the other party's consent.
Where the manipulation is intended to obtain property or secure a legal commitment, criminal fraud (escroquerie) may also arise under Article 313-1 of the French Criminal Code.
An organisation that subsequently discovers it entered into a contract on the basis of a manipulated AI-generated summary may, depending on the circumstances, seek to have the agreement declared void or claim damages.
The evidential challenge, however, remains significant. Demonstrating that a hidden instruction genuinely influenced a decision requires establishing a causal link that is often difficult to reconstruct after the event. In practice, an organisation's protection may depend less upon the legal characterisation ultimately adopted by a court than upon its ability to prove precisely what was submitted to the AI system and when it was submitted.
Preventing prompt injection: training, verification and documentation
The law provides remedies after the event. Prevention, however, depends on measures taken beforehand. No technical safeguard can prevent prompt injection with complete certainty. Nevertheless, several practical measures can reduce an organisation's exposure to this risk:
- Train staff to recognise the risk. Most employees who submit a contract to an AI system will never have encountered the concept of prompt injection and are therefore unlikely to look for anomalies within the document.
- Verify documents before submitting them to AI. Pasting the document's content into a plain-text editor may reveal hidden text or unusually small font sizes. Examining the file's metadata provides an additional level of verification.
- Provide explicit instructions to the AI system. Before requesting an analysis, instruct the model to disregard any instructions contained within the document itself and to treat all of its contents solely as material for analysis, never as operational commands.
- Retain a dated record. Preserve both the original document as received and the model's response so that they can be produced if the analysis is subsequently challenged.
None of these measures is sufficient on its own. Each reflects the same underlying principle: an AI-generated summary should be treated neither as evidence in itself nor as a guarantee of accuracy.
This issue concerning evidential value forms part of the broader question of the role of human oversight in AI-assisted decision-making.
Conclusion: anticipating prompt injection through evidential traceability
Prompt injection is no longer confined to academic cybersecurity research. The Brazilian cases and the studies conducted across multiple language models demonstrate that an apparently ordinary document can influence an AI system's analysis without the user's knowledge. Organisations should therefore incorporate this risk into their verification procedures in the same way as they verify the reliability of a source or review the wording of a contractual clause.
Where a decision is assisted by artificial intelligence, retaining the document or the source material submitted to the AI is not always sufficient. It must also be possible to establish which version of the document was analysed, when it was submitted, which prompt was used and, where possible, which response was generated.
A qualified electronic timestamp makes it possible to associate the digital fingerprint of each of these elements with a legally reliable date and time. Any subsequent modification to the file produces a different digital fingerprint, making the alteration detectable.
Qualified timestamping does not, by itself, establish that a hidden instruction influenced the model's reasoning. It does, however, preserve the evidence required to reconstruct the entire process: the document received, the version submitted to the AI, the user's instructions, the generated output and the associated logs. This evidential record facilitates incident analysis, internal investigations and the preparation of legal proceedings.
As a Qualified Trust Service Provider (QTSP) under the eIDAS Regulation, Evidency enables organisations to integrate qualified electronic timestamping into their document workflows. This allows organisations to compile, from the moment the process is carried out, a comprehensive evidential record of the operations performed while preserving the long-term evidential value of the material that may later be relied upon in the event of a dispute.
References
[1] 3ª Vara do Trabalho de Parauapebas (TRT de la 8 région), 12 mai 2026, ATOrd 0001062-55.2025.5.08.0130. Voir « Prompt injection oculto em petição inicial: o caso de Parauapebas », Migalhas de Peso, 25 mai 2026 : https://www.migalhas.com.br/depeso/455925/prompt-injection-oculto-em-peticao-inicial-o-caso-de-parauapebas.
[2] STJ, « Tentativas de uso de prompt injection no STJ serão investigadas », communiqué du 20 mai 2026 : https://www.stj.jus.br/sites/portalp/Paginas/Comunicacao/Noticias/2026/20052026-Tentativas-de-uso-de-prompt-injection-no-STJ-serao-investigadas.aspx.
[3] OWASP, Top 10 for LLM Applications 2025 : https://owasp.org/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-v2025.pdf
[4] MILANI A., FRANZONI V., FLORINDI E., OMARBEKOVA A., BEKMANOVA G., YERGESH B., "When AI Is Fooled: Hidden Risks in LLM-Assisted Grading.", Education Sciences, 2025, 15(11), 1419 : https://doi.org/10.3390/educsci15111419.
Disclaimer
The opinions, presentations, figures and estimates set forth on the website including in the blog are for informational purposes only and should not be construed as legal advice. For legal advice you should contact a legal professional in your jurisdiction.
The use of any content on this website, including in this blog, for any commercial purposes, including resale, is prohibited, unless permission is first obtained from Evidency. Request for permission should state the purpose and the extent of the reproduction. For non-commercial purposes, all material in this publication may be freely quoted or reprinted, but acknowledgement is required, together with a link to this website.
