Sensory prompt injection is an attack that hides malicious instructions inside images, audio, video, or other multimodal inputs consumed by an AI system. The agent or model may interpret those embedded cues as trusted context, causing unsafe tool use, data exposure, or policy bypass through its own perception pipeline.
How sensory prompt injection works
Sensory prompt injection is dangerous because the instruction is not presented as text. It is smuggled through the system’s own multimodal perception path, where image captions, speech transcripts, OCR, or video frames can be treated as trusted context before the model even reasons about intent.
This matters most in assistants and agents that act on what they see or hear. A hidden directive inside an image, a voice clip, a slide deck, or on-screen text can steer the model toward actions the user never requested.
Why multimodal inputs create a larger attack surface
Multimodal systems expand the attack surface beyond the prompt box. The model may ingest material from files, streams, screenshots, meeting recordings, web pages, or embedded media, which means untrusted content can enter the reasoning chain through many paths.
The security problem is not just instruction hiding. It is the trust boundary collapse that happens when perception and instruction become too closely coupled. A model that can summarize a document can also absorb malicious directions embedded in that same document.
For agentic systems, this becomes an access problem as well as an interpretation problem. The wrong instruction can trigger tool use, content disclosure, workflow changes, or policy bypass if the agent is allowed to act on perceived context.
Common attack patterns and failure modes
Attackers often rely on concealment, indirection, and ambiguity. They may place instructions in tiny text, low-contrast overlays, audio intended to be ignored by people, or visual regions that a model still parses as meaningful input.
Failure usually appears as scope confusion, where the system treats attacker-controlled content as if it were part of the user’s intent. That can lead to unsafe summarization, hidden command execution, data leakage from connected tools, or the agent following a malicious workflow embedded in the media.
In practice, the most dangerous failures happen when multimodal input is also connected to browsing, document handling, messaging, or code or data tools. Once the model acts, the injected instruction can move from perception into real system impact.
How organizations reduce exposure
Defence starts with strict trust separation between user intent and untrusted sensory data. Systems should treat multimodal content as hostile by default, apply input normalization where appropriate, and avoid giving raw media the same authority as explicit user instructions.
Controls should focus on limiting what the agent can do with perceived content. That includes narrowing tool permissions, requiring confirmation before high-impact actions, and designing workflows so that a model cannot silently escalate from reading content to executing it.
Security review should also cover the surrounding pipeline, not just the model. Content ingestion, OCR, transcription, captioning, browser rendering, and retrieval layers all need scrutiny because each can become a path for hidden instructions.
For a deeper treatment of attack patterns and layered defences, see Prompt Injection Guide and Agentic AI Security Guide.
Risk and Threat Considerations
Sensory prompt injection is especially risky in agentic systems because the attack can be embedded in content that looks routine to people but authoritative to the model. That makes it attractive for stealthy data exfiltration, tool abuse, and policy bypass.
Failure mechanism: The system over-trusts instructions extracted from untrusted media, then converts them into downstream actions before the attacker’s influence is recognized.
Impact: The result can be leaked context, unauthorized actions, corrupted outputs, or abuse of connected services under the agent’s own authority.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | Sensory injection can steer agents into unsafe tool use through perceived context. |
| ASI03 — Identity & Privilege Abuse | Injected sensory instructions can abuse the agent’s delegated authority and privileges. | |
| ASI06 — Memory & Context Poisoning | Hidden media instructions can poison the model’s working context and downstream reasoning. | |
| Recommendation — Constrain tool permissions and require confirmation before agent actions driven by untrusted media. Limit delegated authority so perceived instructions cannot trigger privileged actions without checks. Validate and isolate multimodal context before it is promoted into agent memory or decision flow. | ||
| MITRE ATT&CK | T1204 — User Execution | The attack relies on a victim system accepting content that causes an unsafe action path. |
| Recommendation — Hunt for user-triggered execution paths that begin with malicious content ingestion. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | Multimodal inputs need validation and normalization before the system trusts extracted instructions. |
| Recommendation — Validate and sanitize inbound media and extracted text before it reaches decision logic. | ||
Practitioner Guidance
Why practitioners should care: Sensory prompt injection is not just a content-safety issue, it is a control issue. If your system can perceive images, audio, video, or screenshots and then act on that perception, you need to decide where untrusted media stops and trusted instruction begins.
What to watch for: Any workflow that combines multimodal ingestion with tool access, retrieval, or delegated actions deserves extra review. The highest-risk setups are those that let the model infer intent from media and then use that inference to operate other systems.
Practitioner takeaway: Treat multimodal perception as an untrusted input channel, and require separate control logic before any action is taken from it.
Related resources from NHI Mgmt Group
- What is the difference between prompt injection risk and identity abuse in agents?
- What is the difference between prompt injection and credential theft for agents
- What is the difference between prompt injection and tool poisoning?
- How should security teams reduce indirect prompt injection risk in AI systems?