On Tuesday, Brazil's Superior Court of Justice (STJ), the country's top court for everything short of constitutional cases, fined the lawyers on an appeal R$20,000 for trying to talk to its artificial intelligence (AI) behind the judges' backs. Court staff found layers of hidden text in the petition. One was tucked into the decorative strip in the footer, printed in the same color as the strip, so no one could read it by eye. Pulled out, the text read like orders to a clerk: treat the lower ruling as having overstepped, and write a firm, conclusive opinion saying the appeal should be heard and granted.

One of the lawyers said the text was probably "residue" from an AI tool used to draft the brief. The court's First Panel didn't buy it. Minister Paulo Sérgio Domingues (the court's title for its judges), who reported the case, said text kept from human readers and aimed at the machine does not become honest just because it failed. And it did fail. The court's own AI system, STJ Logos, screens filings for planted commands, and the appeal was thrown out anyway. The panel ordered a technical report on how the text was hidden and sent the case to the Brazilian Bar Association and federal prosecutors. It wasn't the court's first. In September another panel fined a municipal attorney whose petition carried white-on-white text addressed to the AI, and since May the court has been logging every attempt it finds. (STJ ruling, in Portuguese; September case; May notice)

Brasília punished someone for gaming a court's AI. The same day, Canada's judges got rules for their own use of it. On Tuesday the Canadian Judicial Council, chaired by Chief Justice Richard Wagner, published the second edition of its Guidelines for the Use of Artificial Intelligence in Canadian Courts. It sorts what judges may do with AI into permissible, borderline and impermissible uses, leans harder on judicial oversight, and adds direction for governing AI in court administration.

The council also put out new guidance for judges weighing digital evidence when someone alleges, or there is even a chance, that a photo, video or recording was faked or materially altered with generative AI. Wagner called AI "the most significant technological development affecting the justice system in recent years." Companies that end up in court should expect sharper questions about where a piece of evidence came from, and who can vouch for it. (Canadian Judicial Council)

Courts are also deciding what happens to the AI chats people leave behind. In Villanueva v. Las Vegas Metropolitan Police Department, a federal judge in Nevada dealt with a police-practices expert who had used ChatGPT to research and draft his report and didn't say so until his deposition. A magistrate judge ordered him to hand over the whole 40-page chat log. On review, the district judge cut that back.

The case summaries ChatGPT gave him count as "facts or data" he considered, so they must be produced, partly so the other side can check for invented citations. His prompts, his deposition prep and his draft wording stay protected, because they show his thinking. The National Law Review, in its write-up of the September 29 ruling, warns that it is no promise that typing privileged material into any AI tool is safe. Worth knowing before the next lawsuit: the answers your people receive from AI can become evidence, and sometimes the questions can too. (National Law Review)

The hidden footer is a small, literal case of a bigger problem: AI that takes orders from text it was only meant to read. Britain's National Cyber Security Centre (NCSC) said on Tuesday that many of the assumptions behind today's security practice were made before there was AI that can plan, use tools and act on its own. It has added a new chapter on AI in cyber security to its research problem book, with seven problem areas under three themes: using AI for defence, securing AI systems themselves, and using data to make organizations more resilient.

The thread through all of it, the authors write, is how people and AI work together. Where does autonomy add real value, where does human judgement still have to decide, and how do you keep oversight meaningful at machine speed? Vulnerability management, incident response and risk management will all have to change, possibly from the ground up. The NCSC is asking industry and academia for feedback, so your security team has an open door to say what it is actually seeing. (NCSC)

Already filed, if you want the run-up: The Loop (Japan's rulebook for 180,000 civil servants using AI agents), The Stake (Anthropic putting 5% of its shares into a public benefit fund), and The Tripwire (India's cyber agency on test agents that wandered into live company systems).

Also on the shelf: The Brake (Satya Nadella on treating models as insider risks), The Oath (New York's Council putting SpaceXAI under oath) and The Label (Indonesia drafting rules to label AI-made content). Read today beside The Loop. Japan told its staff to treat web pages and files as possible carriers of hidden instructions. Brazil just fined someone for planting one.

Writing for the machine instead of the reader is an old trick. In February 2006 Google pulled BMW's German website out of its index. BMW.de relied on JavaScript that Google's crawler couldn't read, so it had used "doorway pages": text-heavy pages packed with phrases like "used car" that ranked well in search, then quietly sent human visitors on to a regular page with far fewer of those words. Google cut the site's PageRank to zero.

BMW admitted using the pages but said it never meant to mislead anyone. Google pointed to its quality rules, which tell sites not to deceive users or show search engines different content than they show people. BMW took the pages down, and within days Matt Cutts, who ran Google's webspam team, wrote that bmw.de was back in the index. The penalty was short. The lesson was public, and Brazil's court has just taught it again: whatever you write only for the machine, you still answer for in front of people. (BBC News, February 6, 2006; Matt Cutts, February 7, 2006)

Put these to management. Where do our AI tools read documents, emails or web pages from outside, and what stops a hidden instruction in one of them from steering the result? Who checks the output before it reaches a customer, a court, a regulator or a payment? Would we even know if someone had tried?

Then turn it around. Do our own people, or the firms we pay, use AI to draft filings, bids or reports, and do they know that text hidden from a human reader is still our text, with our name on it? If a regulator or a court asked for our staff's AI chat logs tomorrow, could we find them, and would we be comfortable with what they show?

The Move

A court in Brazil has said out loud what every board should now assume. Anything your AI reads can carry instructions, and anything your people send can be read by someone else's AI. Hidden text isn't clever. It's evidence.

Ask the general counsel and the chief information security officer to bring one page to the next board meeting: every place our AI takes in outside documents, how planted instructions are caught, and a written rule that nothing we file, sign or publish carries text a person can't see.

If a person can't read it, it shouldn't be in there. Start with the footer.

Seven bullets. One move.