What You See Is Not What the AI Reads

Every document you hand to someone rests on a quiet assumption: that they read the same words you wrote. Not the same fonts or the same margins, the same words. A Connecticut judge spent fourteen pages in August on what happens when that assumption turns out to be false.

The filing at the center of it looked ordinary. Inside it, set in tiny white type on white paper, sat a block of instructions addressed to any artificial-intelligence system that might read the document. The instructions told that system to agree with the filer.

What happened in Connecticut

In Elliott v. New York Bariatric Group, LLC (Conn. Super. Ct., Judicial District of Ansonia/Milford at Milford, Docket No. AAN-CV-25-6066141-S), a self-represented plaintiff filed a motion carrying concealed text. The court described it as formatted to be invisible to a human reader while remaining fully legible to any software that reads the document’s text. Judge Walter M. Spader, Jr. issued an order to show cause, held a hearing, and in a decision dated August 6, 2026 rescinded the plaintiff’s ability to file electronically. Future filings go in on paper, in person. There was no fine.

Two details are worth keeping.

The first is how anyone found it. No scanner caught it and no alarm went off inside an AI tool. Judge Scott Schlegel, who had wondered in print months earlier whether this would reach the courts, described the discovery in his post We Are Not Reading the Same Brief: someone noticed the filings seemed to hold more white space than that person’s other filings, and took a closer look.

The second is that it did not work. The Connecticut Judicial Branch does not use artificial intelligence to review or decide filings, and the judge denied the motion working from a printed copy. The hidden text never reached a machine that would have obeyed it. The court sanctioned the attempt anyway, reasoning that a concealed instruction is improper whether or not it lands.

The part that is about you, not the filer

The decision does not stop at the person who did it. It carries a section addressed to the bar, and that is the part I would read twice if producing or receiving documents is your job.

The court’s observation is that the hidden instruction was aimed at opposing counsel as much as at the court. Anyone who ran that filing through a tool was a target. And it widens from there: an opponent’s production, a witness statement, an expert report, any incoming document can carry the same thing. The court goes further and notes the risk runs to what you feed your own tools from the other side, and possibly from your own clients.

The remedy the court lands on is not a product. In its words, the last defense is “the human reading their output.”

How a page hides text

None of this requires anything exotic. The usual methods:

• Matching the background. White type on white paper, or any color that matches what sits behind it.
• Type too small to read. Set small enough that nobody would read it even after noticing it.
• Under something opaque. Text sitting beneath a black box or an image, which is what a failed redaction leaves behind.
• Off the page. Text positioned outside the printed page area.
• On a layer that is switched off. Still in the file, just not drawn.
• Marked invisible. Text a PDF can carry with instructions to render nothing at all.

In every one of these the words remain in the file. A person sees a clean page. Anything that reads the file as text reads the words.

Why it matters twice

Once on the way out, once on the way in.

Going out. A file you produce can carry text the page does not show you. If someone else’s black box sits over live text and you pass that document along, the text travels with it. If a document picked up hidden content somewhere upstream, that travels too. The page looks finished. The file is not, and the name on the delivery is yours.

Coming in. When you give a received document to an assistant, a summarizer, or a chatbot, what you hand over is the file’s text, not the page’s appearance. A summary or a translation drawn from a document carrying a hidden instruction can tilt toward one party’s account while you have no idea why it reads the way it does. If your own report or advice rests on that summary, you would rather know early. The useful order is to look at the file on your own machine first, then decide what to share and with what.

This is not only my reading of it. Thomson Reuters wrote about the same case on September 4, in a post on its CoCounsel blog, noting that documents imported into CoCounsel go through optical character recognition, which captures only text visible to the human eye. Its advice to anyone on the receiving end is worth repeating as they put it: “Flag it, show it, let the human decide.” That is the right shape of the answer. Someone who pastes a received PDF straight into a general chatbot has nothing doing that for them.

What Lex Cloak does about it

Lex Cloak looks for text a page carries but does not show, and it does not stop at telling you.

• It finds it by reading what the file says is on the page, then comparing that against what the page actually renders, and noticing where the two disagree.
• It shows it. Hidden text arrives in the match list as its own group, with a dotted outline where it sits and a line saying how it was hidden and which personal details it holds. Text outside the page is outlined as a thin strip along the nearest edge. The group is always on, so its switch cannot be turned off.
• It takes it out of the file you save. That happens without drawing a box, so nothing you can read on the page changes. The checklist before you download names the pages it was found on, and a note afterward says how much came out.
• It checks the saved file before handing it to you. If hidden text is still in there, or a page could not be checked, the export stops and names those pages. You can look at them, and if they hold nothing sensitive you can export anyway. The note afterward records that you did.

That last step is the one I care about most, because it is the difference between a tool that tries something and a tool that reopens its own work and looks.

Two limits, stated plainly. In version 1.10.0, hidden text drawn on top of other ink is not something this finds. And this is not a prompt-injection detector. It does not judge what hidden text says, or decide whether a passage is an attack or a leftover. It finds text the page does not show, puts it in front of you, and removes it from the file you send. What the words mean is your call, which is the same division of labor as the rest of what Lex Cloak marks.

The unglamorous answer

The Connecticut court’s answer to all of this was human review, and I think that is right. The part software is good at is the tireless part: looking at a page one way, then the other way, and flagging where they do not match. Deciding what a discrepancy means, and what to do about it, needs the person whose name is on the work.

The scan runs on your own machine and the document stays with you. If you want the detail, the help page on red boxes and the review loop walks through what hidden text looks like in the match list and what each control does. You can also read about the private-by-design approach, or start from the home page and try it on a document of your own.