A text-in-image attack is a prompt injection technique that hides instructions inside an image so an AI system may read and follow them through OCR or multimodal parsing. The attacker uses the image as an input channel, so the hidden text can bypass simple text-only filtering and influence model behaviour or tool use.
How Text-in-Image Attacks Work
Text-in-image attacks hide malicious instructions inside pixels instead of plain text. That matters because OCR and multimodal parsing can surface the embedded prompt after a simple text filter has already decided the input looks harmless.
The technique is especially effective when the target system treats images as trusted user content, extracts text automatically, and then blends that text into the model’s working context. The image can carry the same kinds of instructions used in ordinary prompt injection, but with a different delivery path.
Because the hidden instructions are embedded in a visual object, defenders often miss them during input validation. The attack is less about image format abuse than about bypassing the boundary between what humans see and what the model consumes.
Why It Is Dangerous for AI Systems
Text-in-image attacks can steer the model toward unsafe outputs, disallowed actions, or unintended tool use. If the model is allowed to follow extracted instructions without strong guardrails, the image becomes a covert command channel rather than just content to analyse.
The risk increases in workflows where the model can summarise documents, read screenshots, process receipts, or interpret user-uploaded files. In those settings, hidden text can influence decisions even when the visible image appears benign to a reviewer.
For agentic workflows, the consequence can extend beyond output quality. A successful injection may change a model’s plan, redirect a tool invocation, or cause the system to act on attacker-supplied instructions as if they were part of the task.
Detection, Exposure Checks, and Control Boundaries
Organisations should treat image ingestion as an attack surface and verify whether OCR, captioning, and multimodal parsers are enabled on high-trust paths. The key question is not only whether images are accepted, but whether extracted text is given the same weight as direct user input.
Exposure review should include upload points, browser-rendered screenshots, scanned documents, and any workflow that forwards image-derived text into a model prompt or downstream automation. If the system cannot explain where the text came from, it is harder to tell whether an instruction was user intent or embedded payload.
Strong baselines include content filtering before and after OCR, separation between descriptive extraction and instruction-following context, and logging of the exact text passed to the model. NIST guidance on containerised and application-adjacent processing is useful when image handling is part of a larger AI service stack, and MITRE ATLAS is a useful reference for prompt-injection-style adversarial behaviour in AI systems.
Defensive Handling and Response
When this attack pattern is suspected, responders should review the original image, the OCR output, and the final prompt transcript side by side. The goal is to determine whether the model acted on hidden instructions, not just whether the visible image looked suspicious.
Defensive handling should also include narrowing what the model is allowed to do with extracted text. If OCR output is only needed for indexing or search, it should not automatically become instruction-bearing context. Separating extraction from execution reduces the chance that hidden text can influence higher-trust actions.
After a suspected compromise, teams should inspect logs for unusual tool calls, unexpected prompt changes, and repeated attempts to smuggle instructions through images. Where model actions are tied to external systems, those side effects matter as much as the prompt itself.
Risk and Threat Considerations
Text-in-image attacks are dangerous because they exploit a trust gap between human review and machine interpretation. A benign-looking image can carry instructions that survive OCR or multimodal parsing and then shape model behaviour, tool use, or downstream decisions.
Failure mechanism: The attacker hides command text inside the image, the parser extracts it, and the system fails to distinguish attacker-supplied instructions from legitimate task content.
Impact: The model may follow unwanted instructions, leak information, trigger unsafe tool actions, or become a stepping stone to broader prompt injection and workflow abuse.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | Text-in-image attacks exploit untrusted input that enters the AI pipeline. |
| AU-2 — Event Logging | Reviewing image-derived prompts depends on logs of extracted text and downstream actions. | |
| Recommendation — Validate OCR and multimodal text before it reaches model prompts or automation. Log OCR output, prompt composition, and tool actions for later review. | ||
| OWASP API Security Top 10 | API8 — Security Misconfiguration | Weak handling of multimodal input often reflects unsafe service configuration and trust boundaries. |
| Recommendation — Harden AI-facing services so image processing cannot silently alter trusted execution paths. | ||
| MITRE ATT&CK | T1204 — User Execution | The attack relies on getting a system or operator to act on attacker-supplied content. |
| Recommendation — Map image-based prompt injection attempts to content-driven execution paths and monitor for misuse. | ||
Practitioner Guidance
What to watch for: Treat any workflow that reads user images as potentially instruction-bearing, especially when OCR output is reused in prompts or automation. The main governance question is whether extracted text is allowed to influence actions without a trust boundary.
Practitioner note: The safest design is to minimise how much image-derived text can directly drive the model. If the text must be processed, keep extraction, interpretation, and action execution in separate stages with explicit review points.
Related resources from NHI Mgmt Group
- Attack Surface Management
- Why do Rails image processing pipelines create a larger attack surface than teams often expect?
- How should teams use text-based image editing without losing control over the final composition?
- Why do vision language models struggle with sequential puzzles and combined image text clues?