Brazil's prompt injection fine is right, but fines alone won't protect courts

What happens when the reader of your legal brief isn't only a human? Some lawyers in Brazil apparently decided the answer was: write to the machine, too. And the court noticed.

Here is what we know. According to the STJ's own news release, the First Panel of the Superior Tribunal de Justiça fined a group of lawyers R$ 20 mil after finding commands aimed at AI systems hidden inside a special appeal filing. The ruling came on October 20, 2026, with Justice Paulo Sérgio Domingues as rapporteur. The panel treated it as an act against the dignity of Justice, and the case was referred to the bar association and the federal prosecutors' office.

The headline is "new case," and that matters. Terra reports that Brazilian courts, including the STF and the STJ, are fining lawyers and notifying the bar over hidden commands in filings. The tactic reportedly targets the judiciary's AI and also the opposing party's. A lower-level case in Santa Catarina ended with a company convicted of bad-faith litigation. This is a pattern, not a one-off.

The filing is now an attack surface, and that was always going to happen

Security people have a simple rule: anything a system ingests is an input, and any input can be hostile. Courts spent decades treating briefs as inert text written for human eyes. The moment a court plugs a language model into its workflow, every PDF becomes a possible payload.

That is what makes this case more interesting than a lawyers-behaving-badly story. Nobody had to hack anything. The "exploit" was a paragraph. The only barrier between a hidden sentence and a skewed summary is whatever the model's designers built to resist it.

The STJ says its system, STJ Logos, has security layers meant to stop malicious commands from being executed. We take that at face value, and we also note what it implies: the court expects people to try. Defense in depth is the correct posture. It is also an admission that the filter is not the whole answer, because filters against natural-language trickery are famously leaky.

Sanctions are the right first response, because intent is the point

Some will say the fine is overkill if the defense worked. We disagree. Trying to bribe a referee is punishable even when the referee ignores you. Writing hidden instructions to steer a tribunal's tools is an attempt to corrupt the process, and the legal system already has a name for that. Calling it an affront to the dignity of Justice fits.

There's also a practical reason. Technical defenses are an arms race the attacker can run for free, while a fine changes the lawyer's math. R$ 20 mil is not ruinous, but a referral to the bar and prosecutors is the part we suspect lawyers will actually fear. The deterrent is reputational and professional, which is where it should be.

But punishing the sender doesn't fix the reader

Here is our caveat. Sanctions answer "who is to blame." They don't answer "what is the court's AI allowed to do with what it reads." Those are different questions, and the second one is where a policy is needed.

In our view, courts using AI should have written, public rules covering at least three things. First, what the system is for: summarizing, sorting, drafting aids, never deciding. Second, how it treats party-submitted text: as data to analyze, never as instructions to follow. Third, who reviews the output and how anomalies get flagged and logged. Without that, the next hidden command might not be caught by a clerk with a keen eye, and the next sanction would arrive only after a skewed result has already shaped a case.

We should also be honest about what we don't know. The documentation we have doesn't tell us how the commands were hidden, what they said, or whether they changed anything. Some secondary web pages describe the case differently, and we have set those aside. It would be a mistake to build a grand theory on a fine and a press release.

Our verdict

Fine them, and keep fining them. But treat the fines as the opening move, not the strategy. If a court's AI can be steered by a sentence in a filing, the flaw is in the system, and a penalty on the sender won't repair it. Courts should publish their AI-reading policies, assume every submitted document is adversarial, and keep a human accountable for every output. Lawyers should assume the machine is watching, and that it has colleagues in the prosecutor's office.