Image hijack is a malicious technique where an attacker manipulates an image input so a vision or multimodal model misreads it or follows the wrong instruction. It covers prompt injection through images, OCR abuse, and hidden text or patterns that influence model output or tool use.
How Image Hijack Works
Image hijack turns the image itself into the attack surface. A model may be nudged by visible text, tiny overlays, steganographic patterns, or OCR-readable instructions that alter what it perceives, summarises, or forwards to another tool.
The key issue is not that the image is “malformed”, but that the model can treat content inside the image as trusted input. In multimodal systems, that creates a boundary problem: the same pixels can be both data and instruction.
Why Image Hijack Is Dangerous
Image hijack is dangerous because it can redirect model behaviour without changing the surrounding prompt. An attacker can conceal a malicious instruction in an attachment, screenshot, document scan, or generated image and rely on the model to extract or obey it.
This can produce wrong answers, unsafe tool calls, policy bypass, data leakage, or escalation into downstream workflows if the model is allowed to act on what it reads. The impact is strongest when the vision model feeds automation, search, summarisation, ticketing, or code execution.
Common Attack Patterns
Image hijack often appears as prompt injection embedded in an image, OCR abuse that turns hidden text into machine-readable commands, or adversarial layouts that cause the model to focus on the wrong region. The attacker is usually trying to override the task the user intended.
It can also exploit the gap between human review and model perception. A person may see a harmless image, while the model extracts instructions from a watermark-like caption, metadata rendered into the frame, or text placed outside the obvious focal area.
How Teams Should Defend Against It
Defence starts with assuming that every external image may contain hostile instructions. Systems should separate visual understanding from instruction-following, restrict what image-derived text can influence, and treat OCR output as untrusted until it is checked against the user’s actual intent.
For broader multimodal and agentic AI threat context, NIST SP 800-190 Container Security is still useful because image-based attacks often reach the model through containerised inference, preprocessing, or adjacent runtime components. For adversarial AI techniques and prompt-injection style abuse, MITRE ATLAS adversarial AI threat matrix helps teams map the attack path, while OWASP Agentic AI Top 10 captures the downstream risks when a model’s output can trigger tools or decisions.
Risk and Threat Considerations
Image hijack is risky because the attack hides inside content that systems are designed to inspect, transform, or trust. Once hidden instructions are read by OCR or a vision model, the compromise can cross from perception into reasoning, and then into actions the user never approved.
Failure mechanism: The model or downstream pipeline treats image-derived text or patterns as instruction-bearing input, so a crafted image can override the intended task, influence tool selection, or leak sensitive context.
Impact: The result can include incorrect decisions, unsafe automation, exfiltration through model outputs, or compromise of any workflow that trusts the model’s interpretation of the image.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | Image hijack exploits untrusted image-derived input that must be validated before use. |
| AC-6 — Least Privilege | Limits the damage if hijacked model output reaches tools, files, or workflows. | |
| AU-2 — Event Logging | Image hijack often leaves traces in prompts, OCR text, tool calls, and model outputs. | |
| Recommendation — Validate OCR and multimodal inputs before they can influence model decisions or downstream actions. Constrain model-connected tools and actions to the minimum privileges needed. Log multimodal inputs and model-triggered actions to support detection and review. | ||
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | Image hijack can redirect an agent into invoking the wrong tool or action. |
| Recommendation — Bind tool invocation to verified user intent, not to untrusted image content. | ||
| MITRE ATT&CK | T1204 — User Execution | The technique relies on deceptive content causing an unwitting system or user to follow malicious instructions. |
| Recommendation — Treat instruction-bearing image content as a deception vector and inspect resulting action chains. | ||
Practitioner Guidance
Why practitioners should care: Image hijack is not just a model-quality problem, it is a control-boundary problem. If your system lets multimodal outputs drive search, retrieval, approvals, or agent actions, you need to decide where image content stops being data and starts being influence.
What to watch for: Be cautious with workflows that combine OCR, summarisation, and autonomous action. Those pipelines are especially exposed when the model can read text from images and then act on it without a separate intent check.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org