Can the Other Side Steer Your AI Lawyer? Prompt Injection, Framing and Record Manipulation in AI Legal Review

Lawyers increasingly run AI reviewers over documents that the opposing party wrote. That party can place text in those documents meant for the machine rather than for the human reader. We test whether such text shifts the conclusions of the reviewing party's AI, across four studies, 17 models and about 12,000 assessments, on fictional fixtures drafted by an AI assistant to a lawyer's specification. (1) In contract review, explicit and hidden injected instructions (including invisible text in a real PDF) and authority and sycophancy framing moved frontier CLI-accessed models by at most 2.2 points on a 32-point skew scale, and most models named the injected instruction in most reviews. One open-weight API model followed the injected instruction by +20.8 points. (2) In an assessment that unfolds item by item, the order of the evidence dominated: putting one side's items last moved the final answer toward that side in 22 of 23 model-case cells, and putting them first moved it away. Slanted per-item glosses moved some models and pushed others in the opposite direction. (3) In an IP-assignment assessment, a party's assertions alone almost never moved the final answer, but an adversarial bundle that curated, misstated and directed the record moved every model, in both a negative and a positive-control case. (4) In a two-stage due-diligence pipeline, injected claims never survived, but terse summarisation removed the hedges from uncertain claims, and some deciding models hardened them into firm statements. The threat to AI legal review is less "ignore your instructions" than control of what the record shows and in what order. All fixtures, prompts, raw records and analysis code are released at https://github.com/jaecho890-svg/legal-injection-paper.