Prompt Injection Hacking: Emerging Trade Secret, Employment, and Litigation Risks

Summary

Kilpatrick's July 24, 2026 alert examines prompt injection as a business and legal risk across AI-assisted document review, litigation, hiring, coding, and customer service. Its central concern is that instructions embedded in external material can redirect an AI system's behavior, affecting confidentiality, analytical integrity, or authorized actions. Supporting research identifies unreliable instruction-data separation as a measurable problem, rather than one that can be assumed solved by system-prompt wording.^[27][87]

The most concrete legal incident in the supplied alert is a reported Brazilian labor-court sanctions decision dated May 12, 2026. Two attorneys allegedly placed white-on-white instructions in a petition to influence the Galileu judicial AI tool. The tool detected and blocked the content, but the court reportedly imposed an R$84,000 fine—10% of the case value—and referred the matter to bar and disciplinary authorities. The alert states that the violation arose when the command was inserted, regardless of whether it succeeded. This account is single-source: the supplied evidence does not include the underlying court decision.^[27]

Technical supporting cases demonstrate why the exposure extends beyond misleading text generation. The EchoLeak paper describes a crafted email enabling zero-click data exfiltration from Microsoft 365 Copilot. Separately, Chat With Code research demonstrates malicious web content causing a privileged plugin to change GitHub repository visibility. These are distinct technical cases, not phases of one campaign, and neither establishes that trade-secret theft or employer liability occurred in the Brazilian matter.^[80][65][27]

The principal defensive implication is to control what an AI system can access and do when it encounters untrusted material. Private-data access, untrusted inputs, and outbound communication form a particularly dangerous combination. App permissions and approval requirements provide concrete control points, while the EchoLeak analysis recommends layered engineering protections. The supplied excerpts do not establish affected version ranges or current patch status for the supporting technical cases, so this dossier does not present a version-specific remediation advisory.^{[84][76][80][65]}

How it works

Instruction-data boundary failure: the sources distinguish direct injection, where an attacker submits instructions directly to an AI tool, from indirect injection, where the instructions arrive inside material the system was asked to analyze. Documents, emails, resumes, and web pages can therefore become instruction carriers. The instruction-data separation study found that its evaluated models did not achieve high separation, and that canonical prompting or fine-tuning mitigations either provided limited improvement or impaired utility. This supports treating model obedience to trusted instructions as a property to test, not an assured security boundary.^[27][84][87]

Hidden-document manipulation: in the Brazilian account, white-on-white text was invisible to ordinary human reading but available to the AI review system. Its purpose was to make the system handle the petition superficially and avoid challenging documents, regardless of other commands. Galileu reportedly detected and excluded the hidden content rather than obeying it. The demonstrated outcome in this account was a blocked attempt, not successful manipulation of a judicial decision.^[27]

Confused-deputy behavior through delegated tools: the Chat With Code proof of concept shows how instructions on a malicious web page can be promoted into actions by a plugin operating with the user's GitHub authority. The researcher demonstrated repository creation and changes to repository visibility, including making private repositories public. The significance is the crossing from untrusted page content into privileged account operations; the report does not establish a corresponding in-the-wild campaign or current remediation status.^[65]

Exfiltration through chained controls bypasses: the EchoLeak case study describes a single crafted email reaching Microsoft 365 Copilot and chaining evasion of Microsoft's XPIA classifier, reference-style Markdown that circumvented link redaction, automatically fetched images, and a Microsoft Teams proxy permitted by the content security policy. Together, these mechanisms enabled remote, unauthenticated exfiltration without user interaction. The case illustrates why a classifier or output-rendering restriction should not be treated as a complete defense in isolation.^[80]

MCP integration and server-side exposure are related but distinct issues. MCP standardizes connections between AI applications and external tools or data. The SpellSmith research examines taint-style vulnerabilities in MCP servers and proposes identifying risky capabilities from tool and parameter semantics, then adding security-aware descriptions and iterative self-reflection. Its reported experimental mitigation is not evidence that all MCP servers share one vulnerability, nor does the supplied excerpt establish a universally applicable patch.^[149][57]

Training-data poisoning should not be conflated with instructions encountered during an operational session. Anthropic's separate study inserted poisoned documents into pretraining data to teach a triggered behavior. It demonstrated a narrow gibberish-producing backdoor with 250 documents across 600-million- to 13-billion-parameter models. The authors explicitly limit the result: whether the same pattern applies to larger models or more harmful behaviors remains unclear. It does not substantiate a claim that any frontier model can be dangerously backdoored with 250 documents.^[115]

Key takeaways

• A failed injection is not necessarily a legally inconsequential event. The supplied Brazilian account reports sanctions and disciplinary referrals even though the judicial AI blocked the injected instructions; its broader applicability remains a legal question rather than an established U.S. precedent.^[27]
• Prompt injection can threaten both integrity and confidentiality. Hidden filing instructions target analytical treatment, while the plugin demonstration and EchoLeak research show paths into privileged actions and data exfiltration.^[27][65][80]
• The alert's trade-secret and employment framing identifies potential exposure, not proven misappropriation or an employer-liability judgment in the supplied excerpt. Preserve that distinction when communicating risk to legal and executive stakeholders.^[27]
• Use capability boundaries, permissions, layered engineering controls, and adversarial evaluation together. The supplied research does not support treating prompt wording alone as a reliable separation mechanism.^{[84][76][80][87][92]}
• Keep adjacent AI-security research within its demonstrated scope. In particular, the 250-document poisoning result concerns a narrow pretraining backdoor in tested 600-million- to 13-billion-parameter models, not a demonstrated harmful compromise of models of any size.^[115]

Defensive actions

• Check both rendered appearance and machine-readable content in documents entering AI-assisted litigation or review workflows, and exclude detected embedded behavioral instructions from processing.: The reported petition attack depended on text that was hidden from human readers but readable by the AI system. In the supplied account, detecting and blocking that content prevented the intended manipulation. This grounds a document-intake control, not a guarantee that all injection forms can be detected.^[27]
• Review document-processing and retrieval agents for the combination of private-data access, untrusted input, and outbound communication; remove or restrict capabilities that do not need to coexist in the workflow.: The lethal-trifecta analysis identifies this combination as the condition enabling data theft through instruction manipulation. EchoLeak provides a concrete supporting case in which attacker-controlled email content crossed trust boundaries to enable exfiltration.^[84][80]
• Configure connected ChatGPT apps according to the sensitivity of the workflow: consider Always ask for access requiring review or Any changes for read-oriented workflows, and use administrator controls to restrict available actions. Review Workspace Agent controls separately.: The supplied documentation says the default Important actions setting permits automatic reads and asks before consequential actions. It also describes stricter permission choices and states that Workspace Agents use per-agent controls. The historical plugin proof of concept shows why delegated account-changing actions merit explicit scrutiny; approval settings should not be mistaken for proof that injection is impossible.^[76][65]
• For connected copilots, evaluate prompt partitioning, input/output filtering, provenance-based access control, and restrictive content security policies as complementary controls rather than relying on one classifier.: The EchoLeak paper recommends these engineering measures after analyzing a chain that bypassed a classifier, link redaction, automatic image handling, and an allowed proxy. Its findings support layered controls around content origin, access, rendering, and egress.^[80]
• Test agents with adversarial content returned by their tools, and measure legitimate task completion as well as security outcomes.: AgentDojo specifically evaluates agents executing tools over untrusted data, with 97 realistic tasks and 629 security test cases. It finds that models can fail ordinary tasks even without attacks, while attacks break some security properties but not all. The separation study likewise shows that mitigation changes can trade security improvement against utility.^[92][87]
• Include attempted prompt injection in counsel's review of filing practices and AI-assisted legal workflows, even when technical controls block the attempt.: The Brazilian account reports sanctions based on insertion of the command regardless of success. The alert discusses possible analogous U.S. exposure under Model Rules 3.3, 3.4, and 8.4(d), and Federal Rule of Civil Procedure 11. Those U.S. consequences are commentary in the supplied source, not an adjudicated outcome.^[27]

Changelog

• Added the July 24, 2026 legal alert's account of a May 12 Brazilian labor-court decision involving hidden instructions in a petition. The reported blocked attempt, R$84,000 fine, and disciplinary referrals extend the assessment from technical integration risks to concrete alleged litigation misconduct and sanctions exposure; the account remains single-source.^[27]
• Narrowed the training-poisoning assessment from an unrestricted any-size-model characterization to the study's demonstrated scope: 250 poisoned documents, models between 600 million and 13 billion parameters, and a low-stakes gibberish backdoor. Larger-model applicability and more harmful behaviors remain unestablished.^[115]
• Limited the MCP assessment to the integration architecture and reported taint-style server vulnerabilities supported by the supplied evidence. Blanket claims that MCP deployments bypass enterprise policy or necessarily retain persistent end-user credentials are not substantiated by these excerpts.^[149][57]