How do attackers use Multi-Modal Prompt Injection?

How multi-modal prompt injection works in practice

Attackers do not need the malicious instruction to be plain text. They can bury it inside an image, PDF, screenshot, slide deck, audio clip, or another medium the model can interpret, then rely on the model to treat that content as part of the task context. The useful mental model is that the attacker is trying to smuggle instructions through the model’s perception layer, not through the user prompt alone.

This is why the attack often succeeds even when the visible user request looks benign. The model may extract text from the media, infer meaning from layout or transcribed speech, and then blend attacker-supplied instructions with the legitimate prompt. The control problem is less about a single malicious sentence and more about whether the system can distinguish user intent from embedded instructions inside untrusted content.

In agentic systems, the danger increases when the model can act on what it sees. NHIMG’s Prompt Injection Guide covers how multimodal payloads, hidden Unicode, and indirect injection techniques can turn ordinary-looking content into an execution path. The attack becomes more serious when the model is allowed to search, send, edit, or retrieve on the basis of that compromised context.

Where the attack surface hides in images, documents, and audio

Different media create different opportunities for hiding instructions. Images can contain overlaid text, tiny captions, steganographic content, or OCR traps. Documents can include visible instructions, comments, metadata, footnotes, embedded objects, or content that only appears when rendered. Audio can carry spoken instructions, transcribed prompts, or carefully phrased command phrases that a speech-to-text pipeline will pass into the model.

The practical issue is that preprocessing steps often expand the attack surface. OCR, transcription, document parsing, and file conversion can surface content that the original user never intended to be acted on, while also stripping away the original visual or contextual cues that might have helped a human spot the manipulation. A defender who only inspects the text prompt misses the real place where the attacker placed the instruction.

That is why media handling must be treated as a security boundary, not a convenience feature. The question is not simply “can the model read it?” but “what parts of the media are trusted to influence behaviour, and what parts must be treated as adversarial input until proven otherwise?”

For agent workflows that consume files, the best operational parallel is to assume every attached asset can carry instructions as well as data. The Browser and Computer-Use Agent Security Guide is useful here because the same trust problem appears when an agent processes external pages, files, and sessions on the user’s behalf.

Why defenders need layered controls, not just prompt filters

Prompt filters alone are too shallow for multimodal attacks because the malicious instruction may never look like a classic prompt. A strong defense stack has to inspect embedded text, metadata, and transformed content, then limit what the model is allowed to do with that content. If an external image or document can trigger tool use, send messages, or change state, the attacker has turned passive media into an active command channel.

Good containment starts with modality-aware parsing. Separate extraction from action, log what was extracted, and treat retrieved text as untrusted until policy checks have run. Constrain the model’s tools so that reading a file does not automatically authorize editing, emailing, purchasing, or credential-related actions. When the system must summarize or classify external media, keep the output path narrow and observable.

NHIMG’s Agentic AI Security Guide is a strong companion reference because it frames prompt injection alongside tool misuse, orchestration, and blast-radius control. The key practitioner lesson is that the model’s ability to understand media is not the same as its authority to act on that understanding.

Risk and Threat Considerations

Multi-modal prompt injection is risky because it collapses the boundary between untrusted content and executable instruction. Once a model can read attacker-controlled media, the attacker can try to steer downstream actions, leak context, or force unsafe tool use without needing a visible text prompt.

Failure mechanism: The system extracts text or meaning from external media, then gives that content too much authority in the model’s reasoning or tool chain. If preprocessing, retrieval, or tool invocation lacks strict separation, the attacker’s hidden instruction can override the intended user task.

Impact: The result can be data exfiltration, policy bypass, unsafe actions, or the model behaving as though the attacker’s instruction is part of the legitimate request. In agentic environments, that can extend from a bad answer to real-world side effects.

Practitioner Guidance

What to verify: Confirm that your pipeline distinguishes raw media, extracted text, and authorized instructions. If the model can process images, PDFs, or audio, verify where OCR, transcription, and metadata parsing occur, and whether those outputs are exposed to the agent as trusted context.

Decision rule: If externally supplied media can influence tool selection, message sending, or state changes, require a policy gate before execution. If the media is only for analysis, keep the model in a read-only posture and block any automatic escalation into tools or workflows.

What practitioners underestimate: The dangerous content is often not the visible prompt. It may sit in a caption, hidden layer, transcript artifact, or metadata field that only becomes meaningful after preprocessing, which is why “sanitise the prompt” is usually too narrow.

Practitioner takeaway: The goal is not to make every modality safe in isolation, but to ensure that no modality can silently become an instruction source with execution authority.

Related resources from NHI Mgmt Group

• What is the difference between prompt injection risk and identity abuse in agents?
• How do attackers turn a supply-chain incident into wider NHI compromise?
• How do attackers operationalise stolen OAuth tokens at scale?
• Why do attackers often check model availability before trying to generate content?