Brazilian Courts Sanction Hidden AI Prompts, but No Altered Judgment Has Been Shown

The cases show enforcement, not a breach count

The public record contains several different factual and procedural settings. It supports that courts and regulators are acting, but not a common outcome or a rate of successful attacks.

The Paraíba case remains contested. The lawyer seeking to suspend the penalties said generative AI had been used only to assist with drafting and that the hidden commands entered the document through an inadvertent export error. Appellate judge Onaldo Queiroga denied emergency relief, finding that the legal questions required fuller review on the merits; he did not decide the lawyer’s explanation, the appellate account says.

The Brazilian Bar Association’s Pará branch also imposed a 30-day precautionary suspension on Castro and Alves while its ethics process proceeds. The measure is preventive rather than a final punishment, and the lawyers retain the opportunity to respond, the disciplinary report says.

A large AI footprint, with no denominator for prompt injection

The incentive to use software assistance is easy to see, but the available statistics do not measure this specific threat. A 2025 study coordinated by lawyer and Federal University of Minas Gerais professor Dierle Nunes and STJ minister Luis Felipe Salomão found that 60% of Brazilian courts used some form of AI. The same reporting put the country’s case backlog at about 80 million. Those figures describe a broad operational setting, not the share of filings carrying hidden instructions or the share missed by screening, the analysis says.

Nunes said the incoming data need to be sanitized before systems process them. He and other experts cited in that account also warned that white text is only one form: attachments, supplementary documents, external links and material retrieved by a system can create other routes for malicious instructions. These are risk assessments, not evidence that those routes have already changed Brazilian rulings.

The STJ says it found prompt injections in its case collection in recent weeks. Its in-house generative system, STJ Logos, launched in February 2025, uses three defenses: preprocessing to separate instructions from data, contextual limits intended to stop external directions overriding core rules, and an output-compliance filter. The court says attempts neutralized by the system will be certified in the case records, mapped for possible procedural sanctions, and investigated through police and administrative processes, in its announcement.

The next test is measurement and due process

The next useful evidence is not another dramatic example of white text. Courts need to disclose how often they detect such instructions, what kinds of documents and workflows are affected, whether the safeguards stop them before an output reaches a person, and how often an alleged prompt is intentional rather than an artifact of drafting software. Without those denominators, detected cases cannot establish either a widespread breach or the absence of one.

For now, the institutional direction is clear but bounded. Courts can preserve human responsibility for judgments while treating documents supplied to AI-assisted workflows as untrusted inputs, screening them and giving accused lawyers a process to contest the inference of intent. That approach addresses the demonstrated problem—the attempted manipulation of document processing—without claiming that the cases prove AI has taken over judicial decision-making.