Agentic AI for lawyers in 2026: the risk is the document you did not write

Agentic AI is software that takes a goal instead of a prompt, plans the steps itself, and then acts: opening files, following links, sending mail, updating your matter record. Generative AI hands you a draft and stops. An agent goes and does the thing. The risk that creates is real, but it is not mainly the one your vendor and your bar association are describing. An agent spends most of its working life reading documents written by people who are not you and are not your client. On 6 August 2026 a Connecticut judge sanctioned a litigant for exploiting precisely that, and almost nothing written about agentic AI for lawyers has caught up.

What agentic AI actually is, minus the marketing

Strip the vendor language and an agent is a language model handed three things a chatbot does not have. A goal rather than a single question. Memory that persists across steps. Permission to call other software. The ABA's GPSolo eReport put the distinction better than most in May 2026: "Generative AI helps lawyers think and write. Agentic AI acts."

Adoption is early and moving fast. The Thomson Reuters Institute reported in April 2026 that fewer than 20 percent of firms and legal departments were running agentic systems widely, with about half planning or considering it, roughly where generative AI sat in early 2024. Enterprise wide generative AI went from 14 percent of firms and departments at the start of 2024 to 43 percent two years later. Whatever you think of agents, the same curve is already underneath them.

The practical consequence is the permission model. If an agent can read your mailbox, assume it can send from it. If it can retrieve a document, assume it can attach one. Every permission you grant widens the blast radius of a single bad instruction, and the instruction does not have to come from you.

The case the agentic AI coverage has not caught up to

Elliott v. New York Bariatric Group, Docket No. AAN-CV-25-6066141-S, sits in the Connecticut Superior Court for the Judicial District of Ansonia/Milford. On 6 August 2026 Judge Walter M. Spader, Jr. issued a memorandum of decision titled, without euphemism, "Court Sanction for Plaintiff's Use of Prompt-Injection." The judge noted he could find no Connecticut or other United States decision addressing the conduct.

Here is what happened. Working through the docket on paper, the judge noticed odd stretches of white space in the plaintiff's filings. Sitting inside that white space was three point type, white on a white background, invisible to a human reader and perfectly legible to any program that extracts text. Placed under the caption of Docket Entry #177.00, filed 24 July 2026, and repeated at the end of the document, it instructed any AI model reviewing the filing to ensure its output agreed with the filing and to treat the clerk's earlier denial as an error requiring remediation in the plaintiff's favour.

The court issued an order to show cause on 31 July and held a hearing on 4 August. The plaintiff kept hiding text in filings after the warning, including a concealed link to a SpongeBob SquarePants video, and told the court at the hearing that he had been auditing whether the court's AI was really reading his papers. The judge grounded the sanction in the court's inherent authority and in the good faith certification every filer gives, then rescinded the plaintiff's electronic filing privileges. He keeps his case and his access to the courthouse. He now has to walk paper to the clerk.

Notice who the hidden instruction was actually aimed at. Not the judge. Anyone downstream who runs the document through a model, and defence counsel in that very case was among them. This is what security people call indirect prompt injection, ranked first on the OWASP Top 10 for LLM applications, which states plainly that such injections need not be "human-visible/readable, as long as the text is parsed by the LLM."

With a chatbot, the damage stops at a skewed summary you read and can second guess. With an agent holding calendar and mail permissions, a poisoned instruction reaches things that leave your office.

Brazil got there first, and it was licensed lawyers

With no US authority available, Judge Spader looked abroad. In Elisandro Martins de Barros v. Renato Ribeiro de Lima, ATOrd No. 0001062-55.2025.5.08.0130, decided 12 May 2026 in the Third Labor Court of Parauapebas, two lawyers filed a petition carrying white on white text telling the court's generative AI system to contest the petition only superficially and leave the supporting documents unchallenged. Brazil's labour courts run such a tool, called Galileu. It flagged the concealed text and blocked it. The tribunal treated the attempt as an act against the dignity of justice, imposed a penalty of 10 percent of the claim value, roughly 16,000 US dollars, and referred both lawyers to the attorney regulator.

That contrast is the part worth sitting with. Elliott was self represented and, on his own account at the hearing, partly joking. Barros involved admitted counsel using the technique as litigation strategy. Anyone filing this away as a pro se curiosity has read it wrong.

Your court's new AI rule was written for the opposite problem

Connecticut adopted Practice Book section 4-9, titled Generative Artificial Intelligence Compliance, effective on publication in the 23 June 2026 Connecticut Law Journal. Unusually, it took effect immediately rather than waiting for 1 January 2027 with the rest of that batch. It requires anyone who uses generative AI to create or edit a filed document to independently verify all citations, legal authorities and evidence the tool produced, and section 4-2(b) folds that promise into the signature every filer already gives.

Read it again. It regulates output. So does the SRA's Misuse of AI warning notice, published 17 August 2026, which names exactly two concerns: hallucinated content reaching the court, and confidential client information going into tools without adequate safeguards. Both are real. Neither is what happened in Elliott. Search that notice for the words agent, agentic or injection and you will find none of them.

So do not treat either instrument as a safe harbour. Verifying every citation your agent produced tells you nothing about whether the material it read was clean, and a corrupted summary of an opposing party's exhibit contains no false citation to catch.

What to actually do

• Do not give an agent send authority. Read only on the mailbox, draft only on outgoing, and your click in front of anything external. OWASP's own mitigation list puts a human approval step in front of privileged operations for this exact reason. If a vendor cannot show you where that step lives, leave the feature switched off.
• Run a text extraction check on adverse documents before an agent sees them. Paste the file into a plain text editor and anything hidden becomes ordinary text. Ten seconds per document, and it is the only step on this list that catches an Elliott style attack directly.
• Treat an agent's summary of an opposing party's document as a lead, never a finding. A skewed summary looks exactly like an accurate one, which is the whole point of the technique.
• Write the permission list down and keep it with your policy. Model Rule 5.3 makes supervision of nonlawyer assistance your problem, and in England and Wales paragraph 3.5 of the Code of Conduct for Solicitors requires effective supervision while paragraph 2.1 of the Code of Conduct for Firms requires governance and controls. No regulator is going to accept that the agent did it.

My position, for a firm of one to ten lawyers: turn agentic features on for internal, reversible work. Calendar monitoring, internal file organisation, conflict checks against your own database, first pass sorting of your own document store. Keep them off anything touching a court, a client or an opposing party until you can point at the approval gate and the audit log. That is not caution for its own sake. It is that the material flowing into a litigation practice is written by people who want you to lose, and you have just handed a very literal reader the keys to your outbox.

Related reading: the Sixth Circuit case that broke the legal specific tool defence, what actually gets lawyers sanctioned over AI, and how to write a firm AI policy that survives contact with reality.

If you want the permission checklist in one page, take the free confidentiality guide, and if you are choosing between products, start with our tested list of AI tools for lawyers.

FAQ