Hidden Prompt Injection in Brazilian Labor-Court Petition Reportedly Tried to Manipulate Galileu

Galileu, an AI tool used by Brazil's labor courts, reportedly detected hidden instructions embedded in an initial petition before the 3rd Labor Court of Parauapebas. The text allegedly told the AI to contest the petition superficially and not challenge documents. Galileu reportedly alerted the judge and blocked the hidden content from processing; the judge then reviewed the material before imposing any procedural consequences.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.2 AI system security vulnerabilities and attacks

The incident involved a prompt injection attack, which is a security vulnerability exploit aimed at manipulating the AI system's behavior.

Additional risk subdomains

• 4.3 Fraud, scams, and targeted manipulation: The attacker attempted to manipulate the AI system to gain an unfair advantage in a judicial proceeding.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The risk was introduced by an intentional human action (a prompt injection attack) targeting the AI system after its deployment.

EU AI Act risk tier

• Risk tier: 2 High Risk

High Risk: The system is used in the administration of justice and democratic processes, specifically assisting a court in processing legal petitions, which has significant implications for fundamental rights.

AI system and alleged parties

• AI system: Galileu, unspecified (Tribunal Regional do Trabalho da 4ª Região)
• AI purpose: Judicial Decision Support; Threat Detection
• Behaviour type: Assistant
• Alleged developer: Tribunal Regional do Trabalho da 4ª Região, Conselho Superior da Justiça do Trabalho
• Alleged deployer: Tribunal Regional do Trabalho da 8ª Região, Judicial system of Brazil, Conselho Superior da Justiça do Trabalho, Brazilian labor courts, 3ª Vara do Trabalho de Parauapebas
• Alleged harmed parties: Judicial system of Brazil, Judicial integrity, Epistemic integrity, Defendants in Brazilian labor cases, Brazilian labor courts

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Negligible. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

People affected

• Occurrences reported: 1
• People reportedly exposed: 2

Potential causes

Management

• Adoption of Non-Institutional AI: Risk of using non-approved AI tools lacking specialized security controls.

Technology

• Prompt Injection Attack: Malicious instructions hidden in petition to manipulate AI output.
• Complexity of Attack Detection: Detecting prompt or data injection is not trivial and requires specialized tech.

Data Inputs

• Untrusted Document Inputs: Petition contained hidden malicious instructions targeting the AI system.

Human Factors

• Need for Human Oversight: Judges must review AI alerts and not rely solely on automated outputs.

Process and Methods

• Lack of Input Filtering: Standard document ingestion processes failed to block hidden prompt injections.

Regulatory Environment

• Need for Compliance Standards: Systems must align with CNJ Resolution 615/2025 and international frameworks.

Information quality

• Classification confidence: High
• Reason for confidence: The report is clear, detailed, and comes from an official judicial source. It explicitly describes the technical nature of the attack (prompt injection), the AI's response, and the human oversight process, leaving little room for ambiguity.

A prompt injection attack targeting the Brazilian labor court AI tool Galileu was successfully blocked. The attack attempted to manipulate judicial outcomes by forcing the AI to ignore documents. It was mitigated by the AI's detection mechanism and subsequent manual review by the judge, representing a minor, successfully managed threat to government functions.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: Brazil
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. The threat was immediately mitigated by the system and judge, representing an ongoing strategic concern rather than an active crisis.
• Autonomy: Human-supervised. The AI system operates with human supervision, alerting the judge who retains final decision-making authority.
• Novelty: Evolved capability. Prompt injection is an established threat, but its application to manipulate judicial AI systems represents an evolved capability in legal-domain exploits.

Impact by dimension

• Physical security: Negligible. No physical systems, infrastructure, or human safety were threatened by this localized incident in a labor court.
• Information security: Negligible. No intelligence capabilities, classified information, or systematic information warfare campaigns were involved.
• Sovereignty: Minor. Represents a minor attempt to manipulate judicial decision-making processes via AI manipulation, but was successfully mitigated by manual verification.
• Economic security: Negligible. No threat to strategic industries, financial systems, or national technological advantages was observed.
• Societal stability: Negligible. No large-scale threats to social cohesion, civil liberties, or population safety occurred.