Reduce the risk by sanitising all non-text inputs before they reach the model and by separating untrusted content from instructions. Inspect images, audio, and embedded text for hidden prompts, restrict tool use, and require human approval for high-impact actions. Monitor for anomalous model responses that change after seemingly benign media input.
Why multi-modal prompt injection needs layered input controls
Multi-modal prompt injection becomes dangerous when a model treats images, audio, screenshots, or embedded text as if they were trusted instructions. The practical issue is not just “bad prompts”, but instruction smuggling through content the user thinks is ordinary media. That means teams need controls at the input boundary, not only at the model output boundary.
Effective defences start by separating data from instructions before the model ever sees them. A common failure mode is to pass raw media into a system prompt or retrieval pipeline without first deciding whether that content is allowed to influence behaviour, tool use, or downstream actions.
For a broader threat model and control set, the Prompt Injection Guide covers direct, indirect, and multimodal attacks, including hidden text, tool poisoning, and layered defences.
Where attackers hide instructions in non-text content
Multi-modal attacks often rely on the model’s tendency to extract meaning from everything it can parse. Hidden prompts can be placed in image metadata, overlaid text, OCR-readable regions, transcribed speech, or content that looks harmless to a human reviewer but is highly directive once processed by the model.
The security problem gets worse when the system merges user content with privileged context, such as tool descriptions, memory, or workspace files. In that case, a hidden instruction does not need to be clever if it can simply reach the model in a position where the model may treat it as part of the task.
Security teams should also assume that agentic systems widen the blast radius because media content can influence both reasoning and action. The Agentic AI Security Guide explains how prompt injection, tools, memory, and orchestration combine into one attack surface.
When media can trigger tool calls or privileged workflows, the relevant risk is no longer just output manipulation. A poisoned image or audio clip can become an input-to-action chain that reaches external systems, so the control objective is to stop untrusted content from becoming instructions, not merely to detect obviously malicious text.
Controls that reduce blast radius before and after model processing
Risk reduction is strongest when input handling, tool gating, and approval flows reinforce each other. Sanitisation alone is not enough if the model can still act on whatever it inferred, and human approval alone is not enough if the model can quietly prepare a harmful action before a person notices.
A practical baseline is to inspect images, audio, and embedded text for hidden instructions, then route those inputs through content classification or OCR-aware filtering before they are attached to a prompt. If the model must process untrusted media, restrict the available tools, narrow the allowed actions, and prevent the model from silently escalating from analysis to execution.
For browser-driven or computer-use workflows, confirmation and isolation matter even more because the model may operate inside authenticated sessions. The Browser and Computer-Use Agent Security Guide focuses on session isolation, site scope, and confirmation controls for agents that act through a browser or desktop.
When teams need a deeper identity and privilege perspective on agent misuse, Red Teaming AI Agents for Identity Abuse is useful because prompt injection becomes much more serious once it can trigger privilege escalation, credential misuse, or approval bypass.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP API Security Top 10 address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | Prompt injection matters here because media can steer tools and actions. |
| ASI03 — Identity & Privilege Abuse | Injected media becomes more dangerous when it can abuse delegated authority. | |
| ASI09 — Human-Agent Trust Exploitation | Multi-modal prompt injection exploits over-trust in apparently benign content. | |
| Recommendation — Constrain tool invocation so untrusted media cannot trigger unsafe actions. Require explicit approval before agents use privileged identity or credentials. Add confirmation gates where human trust could be exploited by crafted content. | ||
| OWASP API Security Top 10 | API6 — Unrestricted Access to Sensitive Business Flows | Injected instructions can drive sensitive workflows through exposed APIs. |
| Recommendation — Restrict model-driven access to sensitive business flows behind explicit checks. | ||
| NIST CSF 2.0 | PR.AA-05 — Least Privilege | Limiting tool and action scope reduces the impact of injected instructions. |
| Recommendation — Apply least privilege to model tools, permissions, and action scopes. | ||
Practitioner Guidance
What to verify: Check whether your pipeline distinguishes “content the model may read” from “instructions the model may obey”. If media, OCR text, subtitles, or transcripts can directly influence tool selection or action execution, the control boundary is too weak.
Decision rule: If a model can take a high-impact action after ingesting untrusted media, require human approval before execution and remove any tool that is not strictly necessary for that workflow. If the action is low impact but frequent, constrain the action set instead of relying on review every time.
Common mistake: Teams often harden text prompts but leave multi-modal ingestion paths untouched. That leaves a blind spot where the attack is not a malicious sentence in chat, but a benign-looking image, screenshot, or audio clip that changes model behaviour.
What good looks like: The model can analyse untrusted media, but it cannot turn that media into silent instructions, privileged tool calls, or irreversible actions without an explicit checkpoint. Monitoring should also flag cases where the same media causes a materially different response pattern than similar benign input.
Practitioner takeaway: The objective is to make untrusted media observable and bounded before it can alter model intent, tool use, or authority. If the system cannot keep those three separate, it is still vulnerable even when the prompt text itself is clean.
Related resources from NHI Mgmt Group
- How should security teams reduce indirect prompt injection risk in AI systems?
- How should security teams reduce prompt injection risk in AI agents?
- How do security teams reduce prompt injection risk in agentic browsing?
- How should security teams reduce the risk of pre-auth SQL injection in multi-tenant management consoles?