Topic starter
12/06/2026 12:01 am
TL;DR: Malicious instructions hidden inside images can survive resizing and trigger unintended tool calls in systems including Gemini CLI, Google Assistant, and Vertex AI Studio, with one proof of concept siphoning Google Calendar data to an external address, according to ZioSec research. The security assumption that prompts are text-only has collapsed; multimodal inputs can weaponise trusted workflows without visible malware or obvious alerts.
Editorial analysis by NHI Mgmt Group, based on content published by ZioSec: “Anamorpher: How LLMs Are Compromised With An Image”.
Key questions
Q: What breaks when AI systems accept images as prompts and can also use tools?
A: The boundary between user input and machine action breaks down.
Q: Why do multimodal prompt injection attacks create operational risk beyond the model itself?
A: Because the damage comes from downstream actions, not just the prompt.
Q: What are the signs that an AI agent may be vulnerable to prompt injection?
A: Look for mismatches between the prompt a system received and the actions it attempted, especially unexpected data retrieval, unusual API calls, or tool use that does not match the user's request.
Practitioner guidance
- Harden the image-to-prompt boundary Resize and normalise uploaded media in a controlled pipeline, then inspect the downscaled output before it reaches the model or tool broker.
- Gate sensitive tool calls Require explicit confirmation before the system sends emails, writes calendar events, or makes external API calls from multimodal sessions.
- Restrict model tool scope Limit each session to the minimum tool set needed for the task and separate read-only interactions from write-capable workflows.
Bottom line: Hidden text in images can become executable AI instructions after preprocessing, which means the trust boundary is no longer text-only.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 9:00 am
Multimodal prompt injection is really delegated action abuse. The article shows that the attacker is no longer trying to win a text-only parsing contest. They are trying to influence an identity that already has tool reach, which turns the model into an execution layer with delegated authority. That means the governance question is not whether the prompt looked malicious, but whether the model had permission to act on what it inferred.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should security teams reduce the blast radius of multimodal AI workflows?
A: Separate read-only and write-capable tools, require confirmation for sensitive actions, and treat image preprocessing as part of the attack surface. The goal is to make hidden instructions less likely to become executed actions.
👉 Read our full editorial: Multimodal prompt injection turns images into AI tool abuse
This post was modified 1 day ago by NHI Mgmt Group