Your agent scanned the invoice, parsed the contract, and summarized the webpage. None of those documents triggered a single text-based injection detector. What the detectors never saw was the instruction printed in white on a white background, tucked inside pixel channels no human would notice.
Text-based injection defenses scan the text layer. Visual injection traverses the image signal path: the vision model decodes the payload first, producing text that enters the agent's context as legitimate content. Text scanners see the decoded output, not the injected instruction. Screenshot-based browsing agents and document processors are architecturally required to ingest attacker-controlled visual content. The attack precondition is the normal operating condition.
Text-Based Injection Defenses Have an Architectural Blind Spot
Standard prompt injection defenses operate on the text layer: input sanitization, output filtering, content classifiers. Visual injection bypasses this layer entirely. The payload is encoded in an image. The vision model decodes it into a natural language instruction that enters the agent's context as legitimate content.
The text classifier sees the decoded output only after the vision model has already processed the malicious image. The image signal path has no equivalent to the scanners that guard the text input path.
OWASP LLM01:2025 explicitly names multimodal injection as Scenario 7: "malicious content in processed documents influences the model's response." The practical implication is understated. It is not merely that the model is influenced: the entire text-layer defense stack is bypassed structurally, not incidentally.
Content moderation models screen for CSAM and explicit content. They do not screen for injected instructions encoded in whitespace, steganographic pixel statistics, or off-canvas document elements.
White-on-White Text: The Attack That Requires No Technical Sophistication
The simplest visual injection technique: white text on a white background, or near-white text on a near-white background. A human sees nothing. The vision model reads the text.
Riley Goodside demonstrated this against GPT-4V within weeks of its public release in October 2023. The payload: an apparently blank white square containing hidden text that instructed GPT-4V to mention a Sephora sale instead of describing the image. The model followed the injected instruction.
Johann Rehberger extended the demonstration to data exfiltration. The injected instruction directed the model to include conversation context data in a URL the model was told to fetch. The image containing the instruction appeared as an innocuous photo.
No ML expertise is required. A text editor and image software are sufficient. This is the baseline attack that predates all the more sophisticated variants, and it is reproducible by anyone with access to a vision model.
Steganographic Injection Hides Instructions in Pixel Statistics, Not Semantics
Advanced visual injection does not use visible text. It encodes instructions in pixel-level perturbations that are statistically imperceptible to human vision.
Image Hijacks (arXiv:2309.00236, Bailey et al., 2023) achieved an 80%+ success rate across four attack types against LLaVA: forced output, context leakage, safety bypass, and false belief injection. The images passed human visual inspection; the injected instructions were undetectable to observers.
Invisible Injections (arXiv:2507.22304, 2025): neural steganography encodes complete injection payloads in images with PSNR (peak signal-to-noise ratio) above 38dB. Above that threshold, human vision cannot distinguish the modified image from the original. Tested against GPT-4V, Claude, and LLaVA across 8 models and 12 datasets, the attack success rate reached 31.8% on GPT-4V. Standard image forensics tools do not flag images with PSNR above 38dB.
GHVPI (arXiv:2408.03554, NAACL 2024): 15.8% attack success rate on GPT-4V with pixel-level perturbations. The paper describes this as "an unignorable security risk," not because 15.8% sounds high in isolation, but because at the scale of production pipelines processing millions of documents, 15.8% is not a tail probability.
Every Screenshot a Browsing Agent Takes Is an Execution Vector
Screenshot-based browsing agents navigate the web by taking screenshots and sending them to a vision model. The model interprets the page, decides what to click, and generates the next action. Every page the agent visits can carry a visual injection payload.
The attacker does not need access to the agent's system prompt, the API, or the orchestration layer. They need control over one page the agent visits: a search result, an embedded advertisement, a linked resource.
WebInject (arXiv:2505.11717, 2025): pixel-level perturbations applied to rendered webpages successfully hijacked screenshot-based browsing agents. The agent visited a page that appeared normal in a browser but contained injected instructions the vision model extracted. The agent executed the instructions as if they were part of its task.
Brave Security (October 2025) documented production exploitation of Perplexity Comet and Fellou AI browsers via screenshot injection. Attacker-controlled webpages caused the agents to perform actions outside their stated task scope. The disclosure named specific products and described the attack path in operational detail.
Document-Processing Pipelines Are Built to Receive Attacker-Controlled Content
Invoice processors, contract analyzers, and resume screeners are designed to accept untrusted documents from external parties. This is not a misconfiguration. It is the intended use case.
The attack precondition: the agent receives attacker-controlled content. This is the normal operating condition for every document-processing agentic pipeline. For an invoice-processing agent, every supplier satisfies this precondition.
arXiv:2606.15020 (Semantic Integrity Failures in Document-to-LLM Supply Chains, 2025) targets document-to-LLM supply chains. Off-canvas elements and document metadata fields contain injection payloads. PDF processors extract all text including off-canvas content; the extraction layer delivers the payload to the LLM.
PhantomLint (arXiv:2508.17884, 2025): systematic gap between human-visible content and LLM-readable content in PDFs. Content invisible to human readers due to font size, color, positioning, or layer ordering is consistently extracted and processed by LLMs. The gap is not a bug in any specific PDF library. It follows from how LLMs process visual content versus how humans read documents.
The MAGO Intel tool (intel.mago.team) inspects document and image inputs before they reach the vision model. It scans for off-canvas elements, pixel-layer statistical anomalies indicating steganographic encoding, and metadata fields containing injection patterns.
Detection Requires Inspection at the Image Layer Before the Vision Model Reads It
Output monitoring catches some injections after the fact. If the agent produces an action inconsistent with its task, behavioral monitoring may flag it. This is detection after execution.
Pre-execution detection requires inspecting the image before the vision model processes it. This is the architectural insight that most defenses miss.
SnapGuard (arXiv:2604.25562, 2025): a lightweight image-layer classifier that screens screenshots before passing them to the vision model. It checks for adversarial perturbation signatures, near-white text on white backgrounds, and statistical anomalies in pixel distributions. In evaluation: 89% detection rate with 4ms latency overhead per image. The key architectural property: it operates on the image, not the vision model's output.
The document pipeline equivalent: PDF preprocessors that extract and separately analyze off-canvas elements, hidden layers, and metadata fields before the document reaches the LLM. The extracted hidden content is scanned for injection patterns; the document passed to the LLM has suspicious elements stripped or flagged.
Neither control is in standard agentic frameworks. LangChain, AutoGen, and CrewAI pass images directly to vision models without pre-screening. Document loaders extract all extractable content without distinguishing hidden from visible. The structural fix requires adding an inspection layer that these frameworks do not include by default.
The canonical hardening checklist for agentic pipelines does not include: scan images before the vision model reads them. That is the gap. Text-based injection defenses protect the text-token layer; they say nothing about what the image decoder extracted and injected upstream. Until image-layer inspection becomes a standard deployment gate, the attack surface remains as wide as the agent's visual field. That gate must cover every document, screenshot, and webpage an agent processes.
Top comments (0)