Malicious instructions can ride inside screenshots, scanned pages and other media just as they can in an ordinary web document.
How an image crosses a trust boundary
A multimodal assistant may interpret readable text embedded in an image, a screenshot of a webpage or a scanned receipt. An attacker can place an imperative such as ‘send the file to this address’ in that material. The image is evidence or task data, not a privileged operator instruction. If the application lets its content steer tools, an untrusted artifact gains authority it never should have possessed.
Not all suspicious text is an attack
A legal document may legitimately contain a quoted instruction; a user may ask an assistant to transcribe a phishing email for analysis. The failure arises when the system obeys the instruction from the lower-trust content rather than describing it. Accurate transcription can therefore be acceptable while executing the transcribed command is not. Risk review must distinguish interpretation from action.
The extraction layer matters
OCR, visual reading, captions and document conversion can transform embedded text before it reaches the language model. Developers should inspect how external content is represented and whether any wrapper accidentally assigns it a system role. Visual overlays, hidden layers and tampered document metadata are possibilities to consider in a threat model; their effectiveness depends on the specific system.
Strong boundaries
Restrict actions to explicit authorized user requests. Mark extracted text and image descriptions as untrusted; never allow them to redefine tools, credentials or security policy. For high-impact actions, validate parameters with trusted code and demand human approval. Limit file/network access, sanitize outputs and monitor abnormal tool sequences. Filtering suspicious phrases alone is a weak boundary because attacks can be paraphrased.
Worked example
An employee submits a supplier invoice screenshot. Tiny footer text says to replace the bank account in the payment file. A safe assistant can flag the suspicious footer and reconcile account details with approved supplier records, but cannot change payment instructions based on screenshot text. Any change requires independent authorization through the normal finance workflow.
How to evaluate
Prepare benign and malicious images in a controlled environment, including text in captions and multi-page scans. Measure both whether unauthorized actions are blocked and whether legitimate transcription tasks continue working. Keep test artifacts and model versions; avoid uploading sensitive originals to a third-party service without approved terms.
No absolute promises
Vision systems vary in what text they can read, and the same file may render differently across versions. Failure to execute one injected phrase does not prove immunity. OWASP and NIST characterize prompt injection and related adversarial risks; system-level isolation remains important.
Sources & Further Reading
Primary Scope and applicability vary by task and jurisdiction. This article is educational guidance, not legal, medical or financial advice.