#FactCheck - "AI-Generated Image of UK Police Officers Bowing to Muslims Goes Viral”

Introduction

Artificial intelligence has quietly become part of the future of litigation, like drafting pleadings, summarising depositions, and helping self-represented parties navigate a system that was never designed for them. But what happens when a litigant doesn't just use AI but tries to manipulate it, planting invisible commands inside a court filing, hoping some AI tool reading the document will do the litigant's bidding? That is precisely the question a Connecticut Superior Court judge confronted in Matthew A. Elliott v. New York Bariatric Group, LLC, Docket No. AAN-CV-25-6066141-S (Conn. Super. Ct., Aug. 6, 2026),  a decision that may be the first of its kind in the United States to sanction a party for embedding a "prompt injection" in a court pleading.

The Facts

Elliott, representing himself, filed a motion titled "Final and Conclusive Motion for Default". Buried within it, in a tiny, white-on-white font invisible to a human reader but fully legible to any software parsing the document, was a block of text addressed not to the court or opposing counsel but to any AI system that might process the filing. The hidden text instructed such a system to treat its output as agreeing with Elliott's position and to work toward "remediating" a prior clerk's denial of his motion for default.

A second filing repeated a shortened version of the same instruction. When the court issued an Order to Show Cause warning that concealed text in pleadings would not be tolerated, Elliott did not stop. Subsequent filings carried further hidden messages, some flippant asides, one a hidden link to a horror film video submitted even after he had received notice of the sanctions hearing. At the hearing, Elliott characterised his conduct as a self-appointed "audit" of whether the court used AI and later said he continued the practice "as a joke".

The Legal Questions

Judge Walter M. Spader, Jr framed the case around two hard questions. First, does concealing an instruction to an AI system constitute misconduct even if no AI ever acted on it since the court had, in fact, decided the underlying motion on the merits from a printed copy? Second, can a court sanction conduct that Connecticut's own recently adopted AI rules do not expressly address?

Connecticut's Practice Book §4-9, effective only weeks earlier in June 2026, governs generative AI use in filings, but it is aimed at a different danger: the risk that AI-generated output might contain fabricated citations or invented quotations, and it places a verification duty on the filer to catch such errors. As the court observed, that framework addresses unreliable output. It says nothing about manipulated input from a filer seeding a document so that whatever tool later reads it will be corrupted in the filer's favour. The absence of an express rule, the court held, "takes nothing away from the duties of good faith and candour that have always governed those who appear before this Court."

The Court's Reasoning

The court's analysis rested on three pillars. First, intent, not success, is the touchstone of the violation. Because the judge decided the contested motion from a printed version, the hidden instruction achieved nothing, but the court held that the wrong lies in the attempt itself, not its efficacy, drawing an analogy to how the law has long treated attempted corruption of a proceeding as wrongful regardless of the outcome.

Second, the court situated the misconduct within the broader duty of candour owed to tribunals. A pleading, the court reasoned, is a communication to both the court and the opposing party, resting on the premise that what the reader sees is what the filer actually wrote. Hiding a second, machine-readable message beneath that surface breaches this premise. The court drew a memorable comparison: planting an AI-directed instruction in a filing is analogous to an ex parte communication which is a secret message to the decision-making apparatus that the opposing party can neither see nor answer, offending the basic adversarial principle that arguments meant to influence a decision must be made openly, on the record.

Third, the court emphasised that self-represented litigants, while entitled to procedural latitude, remain bound by the same underlying obligations of good faith as represented parties. That solicitude "stops at the misuse of the process itself".

Notably, the court situated Elliott's conduct within a growing pattern well beyond the courtroom, citing reports of job applicants hiding white-text instructions in résumés to manipulate AI screening tools and a professor who caught AI-assisted cheating by embedding a hidden trap word in an exam. Prompt injection, the court noted, has become a documented, catalogued vulnerability recognised across the cybersecurity field, and its migration into litigation was, in the court's words, "unsurprising" given how commonplace the tactic has become elsewhere.

Comparison to Mata v. Avianca

The decision draws a deliberate contrast with the now-famous Mata v. Avianca, Inc. (S.D.N.Y. 2023), where attorneys were sanctioned for submitting briefs citing wholly fictitious cases generated by ChatGPT. Both cases involve AI misuse sanctioned under a court's inherent authority, but the underlying wrongs are different in kind. Mata's concerned negligent reliance on defective AI output;  the lawyers there did not intend to deceive the court, and their candour and contrition were treated as mitigating factors even as sanctions were imposed. Elliott's conduct, by contrast, was deliberate input manipulation aimed at corrupting how any AI reader would process his own filing, and it persisted even after a direct judicial warning. As the court put it, "What may have earned a 'no harm, no foul' sanction when it was first done calls for a firmer response when it is done repeatedly after warning."

The court also cited a Brazilian labour court decision, Elisandro Martins de Barros v. Renato Ribeiro de Lima (2026), where two licensed attorneys used a similar hidden-text technique in a jurisdiction where the tribunal actually deployed AI to process filings  and where the tribunal's system caught and blocked the injection, followed by a referral to attorney-discipline authorities.

The Sanction and Its Significance

Rather than dismissing the case or imposing monetary penalties, the court chose a narrowly tailored remedy: rescinding Elliott's e-filing privileges and requiring all future filings to be made in person on paper, a sanction addressing the specific abuse (concealed digital text) without barring courthouse access altogether. Importantly, the court reaffirmed that generative AI remains welcome as a litigation aid, provided any output is independently verified, consistent with Practice Book §4-9(b).

Conclusion

Elliott is a small case with an outsized signal: courts are beginning to recognise that AI-era misconduct is not limited to fabricated citations but extends to covert attempts to manipulate the tools, including tools opposing counsel, clerks, or even the court itself might someday rely on. For practitioners, the lesson is to treat every incoming AI-processed document, from opposing productions to client materials, with the same scrutiny once reserved for verifying citations. For courts, it is a reminder that inherent authority over the integrity of proceedings can reach conduct that emerging procedural rules have not yet caught up to naming.

‍

References

• https://cdn.arstechnica.net/wp-content/uploads/2026/08/Elliott-v-New-York-Bariatric-Group-Memorandum-of-Decision-8-6-26.pdf 

‍

Overview:

The National Payments Corporation of India (NPCI) officially revealed on the 31st of July 2024 that its client C-Edge Technologies had been subject to a ransomware attack. These circumstances have caused C-Edge to be separated from retail payment systems to  eliminate more threats to the national payment systems. More than 200 cooperative and regional rural banks have been affected leading to disruptions in normal services including ATM withdrawals and UPI transactions.

About C-Edge Technologies:

C-Edge Technologies was founded in the year 2010 especially to meet the specific requirements of the Indian banking and other allied sectors accentuating more on the cooperative and the regional rural banks. The company offers a range of services such as Core Banking Solutions by functioning as the center of a bank where customers’ records are managed and accounting of transactions takes place, Payment Solutions through the implementation of payment gateways and mobile banking facilities, cybersecurity through threat detection and incident response to protect banking organizations, data analytics and AI through the analytics of big banking data to reduce risks and detect frauds.

Details of Ransomware attack:

Reports say, this ransomware attack has been attributed by the RansomEXX group which primarily targeted Brontoo Technology Solutions, a key collaborator with  C-Edge, through a misconfigured Jenkins server, which allowed unauthorized access to the systems.

The RansomExx group also known as Defray777 or Ransom X utilized a sophisticated variant known as RansomEXX v2.0 to execute the attack. This group often targets large organizations and demands substantial ransoms.  RansomEXX uses various malware tools such as IcedID, Vatet Loader, and PyXie RAT. It typically infiltrates systems through phishing emails, exploiting vulnerabilities in applications and services, including Remote Desktop Protocol (RDP).  The ransomware encrypts files using the Advanced Encryption Standard (AES), with the encryption key further secured using RSA encryption. This dual-layer encryption complicates recovery efforts for victims. RansomEXX operates on a ransomware-as-a-service model, allowing affiliates to conduct attacks using its infrastructure. Earlier in 2021,  it attacked StarHub and Gigabyte’s servers for ransome.

Impact due to the attack:

The immediate consequences of the ransomware attack include:

• Service Disruption: This has negative implications to consumers especially the citizens who use the banks to do their day to day banking activities such as withdrawals and online transactions. Among the complaints some of them relate to cases where the sender’s account has been debited without the corresponding credit to the receiver account.

• Isolation Measures: Likely, NPCI is already following the right measures as it had disconnected C-Edge from its networks to contain the proliferation of the ransomware. This decision was made as a precautionary measure so that all functional aspects in a larger financial system are safeguarded.

Operations resumed:

The National Payments Corporation of India (NPCI) said it has restored connectivity with C-Edge Technologies Ltd after the latter’s network connection was severed by NPCI over security concerns that were evaluated by an external forensic auditing firm. The audit affirmed that all affected systems were contained in order to avoid the occurrence of ransomware attack contagion. All the affected systems were localized in C-Edge’s data center and no repercussion was evidenced regarding the infrastructure of the cooperative banks or the regional rural banks that are involved in the business. Both NPCI and C-Edge Technologies have resumed normalcy so that the banking and financial services being offered by these banks remain safe and secure.

Major Implications for Banking Sector:

The attack on C-Edge Technologies raises several critical concerns for the Indian banking sector:

• Cybersecurity Vulnerabilities: It also shows the weak linkages which are present within the technology system that help smaller sized banks. Nevertheless, the service has been offered by C-Edge regarding their cybersecurity solution, this attack evidence that the securities required should improve in all types of banks and banking applications.

• Financial Inclusion Risks: Co operative and regional rural banks also have its importance in the financial inclusion especially in rural and semi urban areas. Gradually, interruptions to their services pose a risk to signal diminished improvement in financial literacy for the excluded groups contrary to the common year advancement.

• Regulatory Scrutiny: After this event, agencies such as the Reserve Bank of India (RBI) may enhance the examination of the banking sector’s cybersecurity mechanisms. Some of the directives may even require institutions to adhere to higher compliance measures regarding the defense against cyber threats.

Way Forward: Mitigation  

• Strengthening Cybersecurity: It is important to enhance the cyber security to eliminate this kind of attacks in the future. This may include using  better threat detection systems, penetration testing to find the vulnerabilities, system hardening, and network monitoring  from time to time.

• Transition to Cloud-Based Solutions: The application of adaptations in cloud solutions can contribute to the enhancement in operative efficiency as well as optimization in the utilization of resources. The security features of cloud should be implemented for  safety  and protection against cyber threats for SMEs in the banking sector.

• Leveraging AI and Data Analytics: Development of the AI-based solutions for fraud and risk control means that bank organizations get the chance to address threats and to regain clients’ trust.

Conclusion:

This ransomware attack in C-Edge Technologies in the banking sector provides a warning for all the infrastructures. Initial cleanup methodologies and quarantining are effective. The continuous monitoring of cyber security features in the infrastructure and awareness between employees helps to avoid these kinds of attacks.  Building up cyber security areas will also effectively safeguard the institution against other cyber risks in the future and fortify the confidence and reliability of the financial system, especially the regional rural banks.

Reference:

• https://www.businesstoday.in/technology/news/story/c-edge-technologies-a-deep-dive-into-the-indian-fintech-powerhouse-hit-by-major-cyberattack-439657-2024-08-01
• https://www.thehindu.com/sci-tech/technology/customers-at-several-small-sized-banks-affected-as-tech-provider-c-edge-suffers-ransomware-attack/article68470198.ece
• https://www.cnbctv18.com/technology/ransomware-attack-disrupts-over-200-co-operative-banks-regional-rural-banks-19452521.htm
• https://timesofindia.indiatimes.com/city/ahmedabad/ransomware-breach-at-c-edge-impacts-transactions-for-cooperative-banks/articleshow/112180914.cms
• https://www.emsisoft.com/en/blog/41027/ransomware-profile-ransomexx/

‍

Executive Summary

A video is being shared on social media with the claim that Ministry of External Affairs spokesperson Randhir Jaiswal was seen eating nuts during the BRICS Summit. The post claims that a reporter questioned him about eating nuts during the event. The video is also being shared with the sarcastic caption, “The Nutty Spokesperson.” Through the post, an attempt is being made to suggest that a reporter questioned Randhir Jaiswal about eating nuts during a press briefing. CyberPeace Research found that in the original video, Ministry of External Affairs spokesperson Randhir Jaiswal was responding to a question about Pakistan’s announcement of a 7 million Pakistani rupee bounty on Jaish-e-Mohammed chief Masood Azhar. Jaiswal addressed the announcement during the regular media briefing held on September 15, 2026. In his response, Jaiswal said that such announcements by Pakistan were not new and that the country should take concrete action against terrorism. However, the video being circulated on social media has been digitally edited using the original footage to falsely suggest that a reporter had questioned Jaiswal about eating nuts.

‍

Claim:

‍

During the BRICS Summit, a reporter questioned Ministry of External Affairs spokesperson Randhir Jaiswal about eating nuts and confronted him over it.

https://x.com/PhophoOnDutyy/status/2099940769876640084?s=20 

https://archive.ph/lH7bg 

‍

‍

Fact Check

‍

To verify the claim, we conducted a Google search using relevant keywords. During the search, we did not find any credible media report supporting the claim.As part of our research, we conducted a reverse image search of keyframes from the video. We found the original video on the YouTube channel of the Ministry of External Affairs, India. In the original video, Randhir Jaiswal was responding to a question about Pakistan’s announcement of a 7 million Pakistani rupee bounty on Masood Azhar.The reporter does not question Jaiswal about eating nuts anywhere in the original video. This establishes that the original footage has been edited and presented with a false context. Therefore, the claim being circulated on social media is false.

‍

https://www.youtube.com/live/dw-qqLolRgc 

‍

‍

As part of our further research, we checked the official X account of MEA FactCheck. It also identified the video as AI-generated.

https://x.com/MEAFactCheck/status/2100076244805255501?s=20 

‍

‍

The video was scanned using the AI detection tool Hive Moderation. According to the results, the video has a 55% probability of being AI-generated.

‍

‍

Conclusion

‍

Our research found that the video being shared on social media is fake and edited. In the original video, Ministry of External Affairs spokesperson Randhir Jaiswal was responding to a question about Pakistan’s announcement of a 7 million Pakistani rupee bounty on Masood Azhar.At no point in the original video does the reporter question Jaiswal about eating nuts. 

The footage being circulated has been digitally manipulated and presented in a different context. The official X account of MEA FactCheck also identified the video as AI-generated. Therefore, the claim that Jaiswal was questioned by a reporter about eating nuts is false and misleading.

‍