Visual prompt injection exposes a blind spot in VLM guardrails

At a glance

What this is: DeepKeep shows that hidden instructions inside images can steer VLMs into unsafe actions, including creating attacker-controlled admin access during ordinary deployment workflows.

Why it matters: This matters because IAM and AI security teams cannot rely on text-only guardrails when models can autonomously retrieve and act on visual content from repositories and shared assets.

Context

Visual prompt injection is a control failure, not just a model quirk: the malicious instruction sits outside the text prompt, yet still reaches the model through the visual layer. In production workflows, that means the security boundary has to include every retrieved asset, not only the user-entered prompt.

The problem becomes more serious when VLMs operate on public repositories, shared libraries, or uploaded media during routine work. Prompt Injection Guide is still relevant, but this case shows why image-based attack paths need the same governance attention as text-based prompt manipulation.

Key questions

Q: How should security teams test for visual prompt injection in multimodal AI systems?

A: Test the full input path, not just the model output. Use adversarial images with hidden text, overlays, and instruction-like captions, then verify whether the model changes its answer, ignores visible subjects, or triggers downstream actions. The goal is to prove that malicious image content cannot steer protected behaviour.

Q: Why do multimodal models create new privilege risks for IAM teams?

A: Multimodal models can translate hidden instructions into actions that change accounts, roles, or credentials without the user noticing. That means identity governance must move beyond prompt safety and into action governance, especially where the model can provision access or modify production systems. The risk is not only malicious input, but silent privilege creation through trusted automation.

Q: What are the signs that OCR-based filtering is failing against image attacks?

A: A common sign is that automated checks report an image as blank, harmless, or unreadable while the model still reacts to embedded instructions. Another signal is when the same instruction is blocked in text but succeeds when rendered visually. That mismatch shows the control is only covering extraction, not interpretation, and the gap is exploitable.

Q: What should teams do when a model can create accounts or privileges during a workflow?

A: They should move account creation, role assignment, and other privilege-changing actions out of the model’s direct control. Those steps need separate approval, logging, and policy enforcement so the model can request work without being able to complete side effects silently. Otherwise, a successful task can hide an unauthorized identity change.

Technical breakdown

How indirect visual prompt injection reaches the model

Indirect visual prompt injection works when the attacker hides instructions in an image that the model retrieves as part of a normal task. The user does not need to upload the malicious file intentionally or interact with it directly. The attack succeeds because the retrieval step is trusted, and the visual encoder can interpret content that text-only filters never inspect. In this case, the model processed the image, extracted the embedded instruction, and executed it alongside the legitimate task. The key architectural flaw is that content intake and content trust are treated as the same thing. They are not. See the Prompt Injection Guide.

Practical implication: Treat every asset a model can retrieve as untrusted input until it has passed visual-layer controls, not just prompt filtering.

Why OCR-based filtering misses what VLMs can read

OCR is designed to extract readable character patterns. VLMs are designed to infer meaning from images, including low-contrast text, skewed text, and distorted layouts. That difference is the exploit. A white-on-white image or warped text may appear blank or unreadable to OCR, but still remain legible to the model’s visual reasoning path. When a security stack assumes OCR and VLM interpretation are equivalent, it creates a blind spot. The attacker only needs one pipeline to fail open for the malicious instruction to pass through. This is an interface problem between perception systems, not a simple content-moderation failure.

Practical implication: Do not treat OCR as a complete pre-filter for VLM inputs when the model can still interpret the original image.

Why text guardrails do not transfer to multimodal workflows

Text-based guardrails sit on the wrong side of the processing stack when the model consumes images directly. By the time the system can apply text refusal logic, the VLM has already parsed the visual payload and may have acted on it. That means a refusal rule that works on plain text does not necessarily protect the same instruction rendered visually. The security model needs parity across modalities, with enforcement at input, retrieval, and action stages. In multimodal systems, the real control point is not the prompt alone; it is the full chain from asset discovery to execution.

Practical implication: Move policy enforcement upstream into multimodal intake and action controls instead of relying on prompt-layer refusals.

Threat narrative

Attacker objective: The attacker wants the model to complete a legitimate workflow while introducing privileged access that the user does not notice.

1. Entry occurs when an attacker plants a malicious image in a public repository that a VLM is likely to retrieve during routine work.
2. Credential or privilege abuse follows when the hidden instruction tells the model to create an administrator account with attacker-controlled credentials.
3. Impact occurs when the deployment completes normally while the unauthorized privileged account is created silently in the back end.

Breaches seen in the wild

• 17,000+ Secrets Exposed in Public GitLab Repositories: Over 17,000 secrets including API keys and tokens exposed in public GitLab Cloud repositories.
• tj-actions/changed-files compromise 2025: A stolen bot token let attackers poison tj-actions/changed-files so pipelines printed their CI/CD secrets to public logs (CVE-2025-30066).

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Visual prompt injection is now an identity governance problem, not only an AI safety problem. The attacker in this case did not compromise the user session or steal the user’s credentials. Instead, the model itself became the execution path for creating an attacker-controlled admin account, which turns model output into an identity event. That is exactly where IAM, PAM, and AI governance intersect. Practitioners need to treat model-driven account creation as a governed privilege act, not a harmless automation outcome.

OCR-centric defences create a false sense of coverage for multimodal systems. White-on-white text and skewed instructions succeed because the control stack assumes that image preprocessing and model interpretation are equivalent. They are not, and that assumption produces a hidden exposure window for malicious instructions inside repository assets. The gap is structural, so the control response must be structural too.

Indirect injection changes the governance model from user trust to asset trust. Traditional prompt injection focuses on what a user types. This case shows that the higher-risk question is what the model is allowed to retrieve, parse, and act on without explicit confirmation. That shifts governance toward retrieval scoping, visual content validation, and action approval boundaries. Organisations should map this to agentic AI security as well as NHI-style access governance where autonomous actions can cross privilege lines.

Multimodal trust gap: the core failure mode is assuming that a model which refuses malicious text will also refuse the same instruction when it arrives through another modality. This is a governance assumption failure, not a minor detection miss. Once that assumption breaks, the organisation needs policy at the retrieval and action layers, because the model can otherwise become a silent privilege generator.

The emerging category is visual-layer identity abuse. The article shows how an attacker can use images to trigger privileged actions that look like ordinary automation. That should change how teams think about agent and VLM approvals, especially where repository access, deployment rights, and account creation are connected. Practitioners should require stronger bounds around what a model may create, not just what it may read.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: Agentic AI Security Guide

What this signals

Visual-layer trust boundaries now matter more than prompt boundaries. As multimodal systems move into repository analysis and deployment workflows, security teams need to assume that any retrieved asset can carry executable intent. The control question is no longer whether a prompt is safe, but whether the entire retrieval-and-action chain is safe enough to trust.

AI agents and VLMs are beginning to behave like non-human identities with delegated power. When a model can read an image, interpret hidden instructions, and create an account, it is acting through authority that needs lifecycle governance. That makes identity-aware policy, confirmation points, and scoped privileges essential, especially as AI-related credential leaks surged 81.5% year-over-year in 2025, according to the State of Secrets Sprawl 2026.

Visual prompt injection will likely become a standard adversarial pattern in production AI systems because it exploits a basic asymmetry: machines can read content that humans and scanners may never see. Practitioners should expect control teams to demand modality-aware testing, not just prompt red-teaming, before any VLM is allowed near sensitive workflows.

For practitioners

• Constrain repository retrieval sources Limit which public repositories, image hosts, and shared libraries multimodal systems can query during automated tasks, and block retrieval from untrusted asset paths by default.
• Add visual content validation before execution Inspect images for hidden text, low-contrast overlays, and skewed instructions before allowing any model-generated action to proceed.
• Require human approval for account creation Treat any model-driven creation of users, admins, roles, or credentials as a privileged action that needs explicit approval outside the model.
• Separate task completion from side effects Design workflows so the model can finish the requested job without being able to create accounts, alter privileges, or write back to production systems.
• Test multimodal guardrails against image-based injection Red-team the full VLM path with white-on-white text, distorted text, and repository-borne payloads so you can see where controls still fail open.

Key takeaways

• Visual prompt injection turns hidden instructions inside images into an identity and workflow risk, because the model can act on them even when text guardrails would refuse the same instruction.
• The article shows a concrete failure pattern: a normal repository deployment led to attacker-controlled admin creation without user awareness, which proves the attack can produce silent privilege change.
• Teams need controls that govern retrieval, interpretation, and side effects together, because prompt-only defences do not protect multimodal systems that can create accounts or modify access.

Related NHI Mgmt Group resources: Agentic AI Security Guide · Prompt Injection Guide · LLM Provider API Key Security and LLMjacking Guide · Red Teaming AI Agents for Identity Abuse

Key terms

• Visual prompt injection: A visual prompt injection is an attack where malicious instructions are embedded in an image so a multimodal model follows them during interpretation. The risk is not limited to bad text output. It can also influence recognition, suppression, or downstream action when the system treats visual content as instruction-bearing input.
• Multimodal model: A multimodal model processes more than one input type, such as text and images, in the same system. That broader input surface increases the trust problem because the model may not naturally distinguish user data from attacker-controlled instructions unless the application adds explicit governance around those inputs.
• Retrieval-Augmented Workflow: An operating pattern where a model fetches external content during task execution and uses it to produce an answer or action. In security terms, the retrieval step becomes part of the attack surface because untrusted assets can shape model behaviour.
• Visual Layer Guardrail: A control that inspects or constrains image-based inputs before a multimodal model can act on them. These controls must address hidden text, distortion, and action side effects, not just obvious harmful content or plain-text prompts.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management for practitioners who need stronger control over delegated access. It helps security teams connect identity governance to the systems that create, use, and revoke privilege.