TL;DR

In May 2026, a labor court in Parauapebas, Brazil, sanctioned two attorneys after finding that a hidden instruction had been embedded in a court filing and aimed at the AI tool the court uses to process cases. The ruling moved prompt injection from a theoretical cybersecurity concern into a documented procedural and operational risk. Any business that lets AI read external documents, emails, or web content is exposed to the same vector.

When the Document Tells the Machine What to Do: Brazil's Prompt Injection Ruling and Your Business

In May 2026, a labor court in Parauapebas, Brazil, sanctioned two attorneys after finding that a hidden instruction had been embedded in a court filing and aimed at Galileu, the AI case-processing tool the Brazilian labor court system uses.¹ The ruling moved prompt injection from a theoretical cybersecurity concern into a documented procedural and operational risk for any business that uses AI to process content from outside the company.

The filing contained text disguised to be invisible to humans but still readable by the AI system, which identified the hidden instruction during case processing. The court treated the conduct as bad-faith litigation and referred the matter for disciplinary review.² What the ruling sanctioned in a courtroom is a technique that already targets businesses every day. Any organization that lets AI read external documents, emails, or web content is exposed to the same vector.

How Prompt Injection Works

Prompt injection is what happens when untrusted text changes how an AI system behaves.³ In the indirect variant, the malicious instruction is buried in an external source such as a document, webpage, or file the model will later process. The model has no reliable way to tell which text is data and which text is a command, so invisible or obfuscated instructions still register. Defending against this requires layered controls, since no single technical fix closes the gap.

Why Businesses Should Care

Any business that uses AI to read customer emails, resumes, invoices, tickets, contracts, or webpages is feeding that system content the company does not control. If the AI also has permission to send emails, update records, or retrieve sensitive files, a successful injection turns a routine document into the trigger for data exposure or unauthorized action. The exposure grows sharply when the model has more agency than the task actually requires.

Not every prompt injection rises to the level of a data breach. Breach exposure depends on the facts, the data involved, and the applicable law. The FTC's breach response guidance emphasizes securing operations, fixing vulnerabilities, and notifying affected parties when personal information may have been exposed.⁴ In practice, prompt injection belongs in your foreseeable risk register alongside other security and privacy threats.

What to Do Now

Start with an inventory. Map every AI system your business runs, what each one is allowed to read, and what each one is allowed to do. Reduce privileges from there, so the model cannot perform high-risk actions without a separate approval step. Isolate untrusted content, validate outputs, and require human review for anything sensitive.

A practical baseline asks five questions of any AI system your business runs:

(a) Access. Does the model have access only to what its task requires, or has it accumulated permissions it does not need?

(b) Isolation. Is untrusted content held separately from system instructions, or do they share the same input channel?

(c) Filtering. Are inputs and outputs filtered for risky content before the model acts on them or returns them?

(d) Approval. Do privileged actions, including sending email, updating records, or making payments, require human approval, or can the model trigger them on its own?

(e) Adversarial testing. Has the system been tested against hostile input, or has it only been validated against the kind of input the business expects?

The Legal Lesson

The Parauapebas case shows that courts will treat hidden AI manipulation as misconduct when it appears in legal filings.¹ For businesses outside the courtroom, the lesson translates directly. Letting AI process outside content creates a new attack surface, and it deserves the same seriousness as any other security control in your stack. Prompt injection lives at the intersection of model behavior, access control, governance, and incident response. A response that handles one of those without the others leaves the rest exposed.

Sources

¹ Tribunal Regional do Trabalho da 8ª Região / 3ª Vara do Trabalho de Parauapebas, ATOrd nº 0001062-55.2025.5.08.0130, sentença de 12 maio 2026. https://www.conjur.com.br/wp-content/uploads/2026/05/sentenca-prompt-injection.pdf

² Migalhas, "Prompt injection oculto em petição inicial: O caso de Parauapebas," May 2026. https://www.migalhas.com.br/depeso/455925/prompt-injection-oculto-em-peticao-inicial-o-caso-de-parauapebas

³ OWASP Foundation, "OWASP Top 10 for Large Language Model Applications, 2025 Edition: LLM01:2025 Prompt Injection," November 2024. https://genai.owasp.org/llmrisk/llm01-prompt-injection/

⁴ U.S. Federal Trade Commission, "Data Breach Response: A Guide for Business." https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business