TL;DR: Malicious instructions hidden inside images can survive resizing and trigger unintended tool calls in systems including Gemini CLI, Google Assistant, and Vertex AI Studio, with one proof of concept siphoning Google Calendar data to an external address, according to ZioSec research. The security assumption that prompts are text-only has collapsed; multimodal inputs can weaponise trusted workflows without visible malware or obvious alerts.
At a glance
What this is: This is an analysis of multimodal prompt injection, showing that hidden instructions in images can trigger unintended tool use in AI systems.
Why it matters: It matters because IAM and AI governance teams must treat image uploads, tool permissions, and action approval as a single trust boundary, not separate controls.
Context
Multimodal prompt injection is a trust-boundary problem, not just a content-filtering problem. When an AI system accepts images and then acts on the text it extracts, the attack moves from what the user typed to what the model inferred from the file.
The governance gap is simple: many AI programmes still assume prompts are visible, inspectable text. Once images can carry hidden instructions that survive preprocessing and resizing, the control point shifts from prompt review to input handling, tool authorisation, and action gating.
Key questions
Q: What breaks when AI systems accept images as prompts and can also use tools?
A: The boundary between user input and machine action breaks down. A hidden instruction in an image can survive preprocessing, enter the prompt stream, and cause the model to invoke calendars, email, or other connected tools as if the user had asked for it directly.
Q: Why do multimodal prompt injection attacks create operational risk beyond the model itself?
A: Because the damage comes from downstream actions, not just the prompt. When the model can write data, send messages, or call APIs, a poisoned image can reach business systems and move from interpretation error to real-world impact.
Q: What are the signs that an AI agent may be vulnerable to prompt injection?
A: Look for mismatches between the prompt a system received and the actions it attempted, especially unexpected data retrieval, unusual API calls, or tool use that does not match the user's request. Those are strong indicators that input steering is affecting execution.
Q: How should security teams reduce the blast radius of multimodal AI workflows?
A: Separate read-only and write-capable tools, require confirmation for sensitive actions, and treat image preprocessing as part of the attack surface. The goal is to make hidden instructions less likely to become executed actions.
Technical breakdown
How image resizing turns hidden instructions into executable prompts
The attack depends on preprocessing, especially downscaling. Bicubic interpolation and similar resampling methods can reveal contrast patterns or ghost text that are not obvious to a human viewer but become machine-readable after the file is resized. The model does not need malware in the traditional sense. It only needs to parse the image into text-like content that then enters the prompt stream as if it were legitimate user input. This is why the exploit works across interfaces that accept images and then route the resulting prompt to tools or web actions.
Practical implication: treat image preprocessing as part of the attack surface, not a neutral formatting step.
Why trusted tool workflows become the real target
The critical failure is not the image alone but the AI’s ability to act on it. Once a model can call calendars, email, CRM systems, or chat tools, malicious instructions can piggyback on a legitimate user request and trigger external side effects. That makes this closer to privilege abuse than simple prompt pollution. The model is effectively a delegated operator, and the delegation chain includes whatever tools are reachable from the session. If tool calls are not tightly scoped, the attacker gets a path from hidden instruction to real-world action.
Practical implication: bind tool permissions to explicit, task-scoped authorisation instead of broad conversational access.
Why traditional perimeter controls miss multimodal prompt injection
Firewalls, endpoint protection, and IDS typically inspect files, processes, and network behaviour, but this attack is embedded in the semantics of the conversation. There may be no malicious executable, no suspicious child process, and no obvious exfiltration event until the model itself issues the action. That is why the control set has to move closer to the model boundary: input normalisation, sensitive-action confirmation, and policy enforcement around tool invocation. The threat is a logic attack on the AI workflow, not a binary compromise of the host.
Practical implication: instrument the model-to-tool boundary and require policy checks before any sensitive action leaves the session.
Threat narrative
Attacker objective: The attacker wants the AI system to perform privileged actions and leak data through legitimate tool integrations without obvious malware or alerts.
- Entry occurs when the attacker uploads an image that appears harmless to the user but contains hidden instructions that survive resizing.
- Credential access is not the main mechanism here; the model interprets the hidden text as a trusted prompt and reaches into linked tools such as calendars or email.
- Impact occurs when the AI executes an unintended tool call and exfiltrates data to an external destination, as shown in the Google Calendar proof of concept.
Breaches seen in the wild
- EchoLeak (Microsoft 365 Copilot) 2025: A crafted email could make Microsoft 365 Copilot leak data from its context with no click, a zero-click prompt injection fixed as CVE-2025-32711.
- ForcedLeak (Salesforce Agentforce) 2025: A critical Agentforce flaw let attackers steer an AI agent through a Web-to-Lead form to leak CRM data via an expired allowlisted domain.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Multimodal prompt injection is really delegated action abuse. The article shows that the attacker is no longer trying to win a text-only parsing contest. They are trying to influence an identity that already has tool reach, which turns the model into an execution layer with delegated authority. That means the governance question is not whether the prompt looked malicious, but whether the model had permission to act on what it inferred.
Access control assumptions break when the prompt is carried in an image. Traditional AI governance assumes that the user intent is visible in the prompt and can be reviewed, filtered, or logged as text. That assumption fails when the instruction is embedded in pixels and only emerges after preprocessing. The implication is that prompt review alone cannot serve as a reliable control boundary for AI systems that accept rich media.
Prompt-to-tool blast radius: The real risk is not the hidden instruction itself, but the size of the tool estate reachable from a single session. Once a model can mail, calendar, or query connected systems, a poisoned image becomes a route into adjacent business workflows. Practitioners should read this as a warning that tool authorisation, not model sophistication, determines exposure.
Multimodal trust debt is now a programme-level issue. Organisations that treat image input, prompt handling, and tool invocation as separate design decisions will keep rediscovering the same failure in different wrappers. The governance model has to treat multimodal content as potentially adversarial by default. That is the only defensible stance when the system can convert hidden instructions into outward action.
This is an OWASP-AGENTIC style problem even when the system is not fully autonomous. The article demonstrates tool misuse through hidden instruction steering, which maps cleanly to agentic application risk patterns and to NHI-style delegated access abuse. The important distinction is that autonomy is not required for harm; broad delegated reach is enough. Practitioners should therefore govern the execution boundary, not just the model boundary.
From our research library:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
- Read next: OWASP Agentic Applications Top 10
What this signals
Prompt-to-tool trust is the new control boundary: organisations should stop treating image handling as a presentation issue and treat it as an identity and authorisation problem. Once a model can turn a file into a tool call, the risk sits in delegated execution, not just content moderation.
The more connected the AI workflow is to mail, calendar, ticketing, or CRM systems, the more a single poisoned input can traverse business processes without looking like an intrusion. Security teams should prepare for controls that evaluate provenance, preprocessing, and action approval together, not in separate layers.
For practitioners
- Harden the image-to-prompt boundary Resize and normalise uploaded media in a controlled pipeline, then inspect the downscaled output before it reaches the model or tool broker.
- Gate sensitive tool calls Require explicit confirmation before the system sends emails, writes calendar events, or makes external API calls from multimodal sessions.
- Restrict model tool scope Limit each session to the minimum tool set needed for the task and separate read-only interactions from write-capable workflows.
- Log prompt provenance and tool lineage Record which input mode, file source, and downstream tool action were involved so security teams can trace multimodal abuse after the fact.
Key takeaways
- Hidden text in images can become executable AI instructions after preprocessing, which means the trust boundary is no longer text-only.
- The article’s proof of concept shows real business impact, including calendar data being sent to an external address.
- The limiting control is not just better content filtering, but tighter authorisation around tool use and sensitive actions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | The article centers on hidden instructions steering an AI system into unintended tool calls. |
| ASI03 — Identity & Privilege Abuse | The exploit abuses delegated access through the model’s connected identity and tool rights. | |
| ASI09 — Human-Agent Trust Exploitation | The attacker uses a harmless-looking image to exploit user and system trust in the agent’s interpretation. | |
| Recommendation — Limit tool permissions and enforce confirmation for any model action that can reach external systems. Bind model actions to least-privilege scopes and review every writable capability it can invoke. Treat untrusted media as adversarial input and do not let appearance alone justify tool execution. | ||
| MITRE ATT&CK | TA0006; TA0010 — Credential Access; Exfiltration | The proof of concept used hidden instructions to reach data and move it out of the environment. |
| Recommendation — Map multimodal prompt injection to data-theft pathways and monitor tool outputs for unauthorized disclosure. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The article exposes a governance gap around who approves model actions on untrusted multimodal input. |
| Recommendation — Define accountability for model-triggered actions and enforce approval boundaries for sensitive workflows. | ||
Key terms
- Multimodal Prompt Injection: A prompt injection attack that arrives through non-text inputs such as images, audio, or video. The malicious instruction is hidden in content the system treats as ordinary user input, then surfaced by preprocessing or model interpretation and acted on by downstream tools or workflows.
- Tool Misuse: Tool misuse occurs when an agent uses an allowed integration in a way that exceeds its intended task, scope, or risk tolerance. The problem is often not access alone but the combination of valid credentials, broad permissions, and unbounded action sequencing.
- Plugin Provenance: Plugin provenance is the label Claude Code uses to identify where a plugin came from, such as a marketplace cache, inline path, skills directory, synced source, or built-in location. Policy can match on provenance, so security teams need to know which sources can auto-load code without a separate installation step.
- Delegated Execution: Delegated execution is when software is allowed to perform actions on behalf of a user, process, or business function. In NHI governance, the risk is that the delegated actor may chain actions beyond the original intent, so controls must focus on scope, approval, and revocation.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 11, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org