From Pingo Borrachinha to Prompt Injection: The Ethical Limits of Client Defense, Twenty-Three Years Later

1. The Question That Returns

Some episodes seem unprecedented and in fact merely repeat, in new attire, an old controversy. The recent case in which two attorneys at a labor court in northern Brazil were preliminarily suspended by their state bar after inserting a hidden command in a complaint — text in white font on a white background, invisible to the human eye but readable by artificial intelligence systems — is exemplary of that repetition. The technique goes by the English name prompt injection. Its repercussion was nationwide. There was an immediate institutional reaction to the episode, given the perception of its potential ethical-disciplinary relevance.

The institutional reaction, however, owed more to the perception, even intuitive, that something familiar had occurred than to any technological novelty. This was not, after all, a new category of ethical misconduct. It was a technological manifestation of something well known to the Brazilian disciplinary tradition — something that has, in fact, a famous precedent. In 2003, hidden cameras from the Jornal Nacional newscast captured the seasoned Rio criminal defense attorney Clóvis Sahione instructing his client, then under investigation in a scheme involving the illegal transfer of foreign currency to a Swiss bank, to deliberately alter his handwriting before the upcoming forensic handwriting examination. The instruction was immortalized in the press by the name of the gesture suggested: the pingo borrachinha — the "little eraser dot," a round, ball-shaped dot over the letter i. The Rio chapter of the Brazilian Bar Association (OAB-RJ) suspended the attorney preliminarily for ninety days, in a unanimous 34-to-0 vote.

Twenty-three years separate the two episodes. The medium has changed — from paper to the XML layer of the electronic filing, from the handwritten gesture to white pixel over white pixel. The underlying question, however, is the same. Where does zealous defense end — with all its persuasive rhetoric, its tactical omissions and selective emphases — and where does procedural fraud begin? That is the subject of this article.

It should be noted, from the outset, that the analysis proposed here does not seek to anticipate any definitive judgment about the disciplinary liability of professionals possibly involved in specific cases, nor to replace the regular investigation by the competent bodies. The episode mentioned is taken as an academic object for its theoretical relevance and because it raises a broader question: identifying the ethical limits of professional conduct in the face of new technologies. The interest of the case lies less in the people involved and more in the legal structure of the conduct being debated.

2. What the Defense May Do: Legitimate Partiality

The question is uncomfortable because it attacks a rarely articulated premise. An attorney, when drafting a complaint or answer, has no duty to present all the facts. They select, emphasize, qualify, omit what does not serve the theory of the case, contradict the opposing party's version, and advance interpretations they know to be minority positions. None of this is unethical, unlawful, or disciplinarily punishable. On the contrary, it is what is expected of a good professional. Partial advocacy is the very essence of the adversarial system.

This legitimate partiality manifests itself in at least six dimensions recognized by Brazilian scholarship and by consolidated disciplinary practice:

• Factual selection. The attorney chooses which facts to narrate, in what order, with what emphasis. Omitting unfavorable facts, whose disclosure is not required by law, is not lying. It is strategy.
• Alternative legal characterization. Asserting, over the same facts, a legal framework different from that of the opposing party is a legitimate exercise of legal interpretation.
• Contradicting the opposing version. Denying facts asserted by the other party, even with internal doubts about procedural truth, is a rule of the adversarial system. The process is, by design, dialectical.
• Defense of minority positions. Sustaining an interpretation contrary to the prevailing view is a professional prerogative and contributes to the evolution of the law.
• Rhetorical emphasis. Qualifying, dramatizing, constructing a persuasive narrative, appealing to constitutional principles when the case is merely patrimonial — all of these are argumentative techniques. None is fraud.
• Preparing the client and the witness. Advising on procedure, demeanor, attire, calmness and focus — an accepted and essential function of the legal profession, recognized including by Formal Opinion 508, of 2023, of the American Bar Association (ABA) Standing Committee on Ethics and Professional Responsibility.

These six dimensions make up the legitimate partiality of counsel. They are protected by the right to a full defense, by the adversarial principle and by the functional independence of the legal profession. None of them is what is at issue when we speak of prompt injection or of the pingo borrachinha.

3. Where Partiality Becomes Fraud

The ethical line does not lie in partiality. It lies in three elements that, when present, transform legal advocacy into disciplinary misconduct: material falsity, illegitimate interference with the means of proof, and breach of procedural loyalty toward the opposing party.

3.1. Material falsity

It is one thing to omit an unfavorable fact; quite another to assert a false fact. It is one thing to characterize a document differently; quite another to file an altered document. It is one thing to advance a minority position; quite another to cite a non-existent precedent — a growing phenomenon in cases of case law fabricated by generative AI, which the Superior Electoral Court and the Superior Court of Justice have been repeatedly sanctioning. The line here is simple: the defense may do anything within the truth. Nothing within the false.

3.2. Illegitimate interference with the means of proof

This is where the richest precedents of the analog era reside, and where the analogy with prompt injection becomes most revealing. The Brazilian disciplinary case law of the last two decades offers at least three paradigmatic episodes.

In 2005, in a high-profile labor case involving a technology multinational, a recorded tape captured the company's director and an attorney from a renowned firm coaching employees on how to answer the court during a hearing, defining both the tone and the content of their answers. At the time, the chair of the relevant bar association's ethics tribunal noted that a coached witness no longer testifies according to their own knowledge — their statements become tainted, and the attorney who acts in this way works against the administration of justice.

In 2016, a labor court in Rio Grande do Sul fined a plaintiff for bad-faith litigation after her attorney was filmed, minutes before the hearing, instructing a witness on the specific content of the testimony — work hours, schedules, recurrence. The regional court upheld the fine and referred the matter to the OAB for ethical-disciplinary review, recognizing a direct affront to the duties of procedural loyalty, good faith and the dignity of the justice system.

In 2024, a virtual hearing before the Labor Justice system in Paraná was suspended after the judge suspected that the attorney and the client were in the same room — even though their cameras suggested separate environments. Pressed to inspect the space, the defendant literally hid under the table. The episode was captured by the camera itself. The regional court referred the matter to the local bar to investigate the attempt to mislead the court.

To these episodes one may add the classic examples catalogued by the ABA: winking at a witness during trial, kicking the witness's leg under the table, passing notes during the proceeding — any non-verbal gesture designed to direct answers in real time. In all of them, the structure is constant. There is a hidden element — a gesture, a note, a whisper, an instruction — designed to interfere, in real time, with the production of evidence or with the technical work of opposing counsel, through a channel invisible to the court and to the other party.

There is an argument that deserves careful examination. In a scenario in which law firms, legal departments and courts are increasingly incorporating automated tools for reading and processing documents, one could argue for the existence of a legitimate concern about the indiscriminate use of such technologies by the opposing party. From that angle, invisible mechanisms of interference could be presented as a form of technological self-protection.

The concern, though real, does not authorize any mechanism of reaction. The legal system has always distinguished legitimate measures of self-protection from hidden expedients designed to clandestinely interfere with the technical work of the opposing party. The problem, therefore, does not lie in the concern about technology, but in the means employed.

3.3. Breach of loyalty toward the opposing party

The duty of procedural loyalty, set out in Article 2, sole paragraph, II, of the OAB's Code of Ethics and Discipline, and in Articles 5 and 6 of Brazil's Code of Civil Procedure, is not owed to the court alone. It is owed equally to the opposing party, to the attorneys on the other side and to the justice system as a whole. It is precisely on this point that the defense advanced in the recent case fails most clearly — the argument that the hidden command was meant to reach not the judge, but the opposing party's response. Sabotaging the technical work of another attorney, by any means, is a fraud as grave as misleading the court. The attempted semantic retraction, far from mitigating, aggravates the conduct.

4. The Sahione Case and the Doctrinal Controversy It Inaugurated

We must now return to the famous 2003 precedent. It is the closest analog paradigm to the recent case and offers a doctrinal lesson that should not be lost.

The facts, in summary. Clóvis Sahione, then 65 years old, a Rio criminal defense attorney with a long career, was representing tax inspectors accused of involvement in a bribery and illegal currency-transfer scheme — more than thirty million dollars wired to a Swiss bank. The court ordered a forensic handwriting examination to compare the clients' handwriting with the records used to open the offshore accounts. Hidden cameras captured the instruction: that the client alter the way he wrote — making the so-called pingo borrachinha, among other modifications — to frustrate the expert comparison. The Rio bar suspended Sahione preliminarily for ninety days, by unanimous vote.

The parallel with the recent case seems direct. The surprise begins when one examines the doctrinal reaction of the time. The Brazilian Institute of Criminal Sciences (IBCCRIM) published a position paper arguing that Sahione had committed no infraction at all. The argument, far from frivolous, was doctrinally sophisticated and divided the legal community.

The thesis defending the attorney

The counterargument rested on three pillars. First: a criminal defendant, in Brazil, has the right to lie in their own defense — there is no crime of perjury applicable to the accused under Brazilian law. Second: the Federal Supreme Court (STF), in Habeas Corpus 77,135-8, of 1998, had already held that no one is required to supply material for forensic handwriting analysis, by virtue of the constitutional privilege against self-incrimination. Third: if the client may lawfully alter their own handwriting to avoid self-incrimination, then the attorney who instructs them to exercise that right is merely fulfilling a professional duty — and would, on the contrary, fail disciplinarily if they omitted that advice.

The thesis is uncomfortable, but cannot be dismissed lightly. It touches on a real point: the client may exercise a right; the attorney has a duty to advise them; therefore, the advice would not in itself be unethical.

The opposing thesis — and what prevailed

There is, however, an equally robust counterpoint. The STF itself, in Recurso em Habeas Corpus 81,327-SP, under Justice Ellen Gracie, decided in 2001 — two years before the paradigm case — had held that an attorney who instructs the client to lie in the case file may be held liable for false testimony. The reasoning is the following: even though the defendant has the right to lie in their own defense, that right is strictly personal; it does not allow delegation or instrumentalization by a third party. The attorney is not exercising the client's right when they instruct them to falsify evidence. They are, rather, actively contributing to evidentiary fraud that goes beyond the constitutionally protected right to remain silent.

It was this second reading that prevailed at the Rio bar. And, more than two decades later, it remains the doctrinally more sustainable reading — not because the opposing thesis is contemptible, but because it conflates two distinct planes: the plane of the defendant's right (who may remain silent and may lie) and the plane of the attorney's duty (who may not produce fraudulent evidence nor instruct the client to do so).

Why the Sahione case matters for the recent one

The controversy inaugurated by the Sahione case is decisive for one precise reason. It demonstrates that, even in the most borderline cases — where a real subjective right of the client is in play, such as the right not to produce evidence against oneself — the ethical line of the legal profession does not coincide with the legal line of the client. The attorney has their own, autonomous duties that exist beyond the legitimate strategy of the defense.

Applying this premise to the recent case: even if one accepted, ad argumentandum, that a party has a legitimate interest in having its arguments examined by the opposing party, this would never authorize an attorney to insert hidden commands designed to sabotage the reading of that very material. As in Sahione, the boundary lies in distinguishing the exercise of the client's right — which is broad — from the duty of the attorney — which has its own, non-delegable limits.

5. The Central Analogy

With the parameters established, the analogy becomes sharp. Prompt injection does not inaugurate a new category of ethical misconduct. It is the digital translation of an old, well-catalogued behavior — hidden interference designed to taint the production of evidence or the technical work of the opposing party.

Although different in their immediate object — one bearing on expert evidence and the other on informational processing by automated systems — the situations share elements that are structurally relevant to the ethical-disciplinary analysis. In Sahione, the attorney instructed the client to alter his handwriting to frustrate the forensic examination: hidden interference in the production of expert evidence. In the recent case, the attorneys embedded a hidden command in a filing to frustrate the AI processing by the court or by the opposing party: hidden interference in the production of documentary evidence. In the 2024 Paraná case, attorney and client pretended to be in separate rooms during a virtual hearing: hidden interference in the production of testimonial evidence.

The common element does not lie in the medium employed, but in the underlying logic of the conduct. The handwritten gesture, the note passed in the hearing room, the clandestine instruction, the invisible command, or the sophisticated technological device are distinct manifestations of the same legal problem: the use of hidden means potentially capable of producing a procedural outcome without submission to the adversarial process.

There is, however, a significant difference that weighs against the recent case. In Sahione, there was still a real doctrinal controversy, anchored in a subjective right of the client — the right not to produce evidence against oneself. In the recent case, that counterpoint disappears. There is no subjective right of a party to sabotage the technical work of opposing counsel. The attempt to justify the act as self-protection against the other party's AI, far from a legally sustainable defense, is a direct confession of breach of the duty of procedural loyalty.

This concern, moreover, does not arise in isolation. The contemporary regulatory movement has been moving toward an increasing demand for transparency, traceability and auditability of automated systems. Recent regulatory models based on risk management reveal a clear trend of incompatibility between opaque mechanisms of algorithmic interference and the institutional duties of trust, predictability and procedural integrity.

Even though the regulatory debate remains in evolution, the direction seems unmistakable: the more automated systems participate in legal activity, the greater the ethical demand for transparency in their use will be.

6. Three Zones, Three Responses

For strictly didactic and systematizing purposes, the following classification is proposed: three possible ethical zones related to the professional use of artificial intelligence. The categorization does not seek to exhaust the hypotheses nor to replace case-by-case analysis, serving only as an instrument of practical understanding.

Green Zone — Legitimate partiality assisted by AI

The professional uses artificial intelligence tools for case-law research, drafting preliminary versions of pleadings, document review and procedural organization. They review the output, verify all sources, validate every cited precedent, and fully assume responsibility for the signed pleading. There is an internal audit trail: a record of which tool was used, in which pleading, with which prompt, and with which output. This is AI as a legitimate productivity instrument and as technical differentiation. No infraction.

Yellow Zone — Negligence and lack of technological literacy

The professional uses AI but does not review the output. They sign a pleading containing case law fabricated by the tool. They do not verify the precedents. They accept the generated text as if it were their own. According to the best scholarship and the growing case law, there is a breach of the duty of diligence set out in Article 34, XXIV, of Brazil's Statute of the Legal Profession. The conduct may not be intentional, but the omission is negligent and disciplinarily relevant.

Red Zone — Deliberate digital fraud

The professional employs prompt injection, metadata manipulation, contamination of documents with hidden instructions, or any other vector of algorithmic manipulation designed to interfere, in real time, with the production of evidence or with the technical work of the opposing party. Here there is no ethically relevant difference from the pingo borrachinha, from the kick under the table, or from the note passed during a hearing. The response must be, as it has been, preliminary suspension and, where intent is proven, the maximum sanction.

7. Conclusion

Technologies change. The medium changes. The instruments become more sophisticated, more invisible, and harder to detect. The engineering of fraud follows the evolution of technology. The ethical boundary, however, remains substantially the same.

The legal profession remains authorized to be strategic, partial and persuasive. Never clandestine.

The defense may select facts, sustain minority interpretations, construct narratives and exercise all the prerogatives inherent to the adversarial system. What it may not do is cross the boundary between legitimate strategy and hidden interference with the integrity of the process.

The digital-law professional now takes on an additional duty: to understand technological mechanisms not only in order to use them efficiently, but also to identify their distortions, limitations and risks.

Technological literacy has ceased to represent a mere competitive differentiator. It has become an ethical requirement.

Twenty-three years separate the pingo borrachinha and prompt injection, which are, in essence, the same act. What changed is the medium. What did not change is the ethical boundary they both crossed.

Rio de Janeiro, May 19, 2026. Cover image: Sasun Bughdaryan / Unsplash.