Seeing Is Deceiving: Visual Prompt Injection in Multimodal AI
Sarah Chen
Head of Security Research · June 20, 2026
Text-based prompt injection was already a serious problem. Multimodal models have opened a second channel: attackers are embedding instructions directly into images as low-opacity text, pixel-level perturbations, or steganographic payloads, and frontier models like GPT-4o and Gemini Pro Vision faithfully follow them. For mobile apps that let users upload photos, scan documents, or process camera frames through an AI feature, every image is now a potential delivery mechanism for adversarial instructions.
How visual injection bypasses text-level defenses
Input validation and content-filtering pipelines are almost universally built for text. An instruction hidden in an image as near-invisible overlay text or a steganographic payload passes every text-based filter and arrives at the model as trusted visual context.
Because multimodal models integrate visual and textual reasoning, an instruction in the image can override a system prompt, redirect tool calls, or instruct the model to suppress its response to the legitimate user query, all without any anomalous text in the request.
The attack surfaces unique to mobile
Mobile apps create several injection entry points that desktop applications rarely face.
- Camera feeds and photo library uploads processed by on-device or cloud vision models
- Document scanning features that pass page images directly into a multimodal context
- QR code and barcode readers whose decoded content feeds an LLM without sanitization
- Screenshot and screen-sharing features that inadvertently capture attacker-controlled content
How RASMISER addresses the multimodal surface
RASMISER identifies where your app routes image, camera, and document inputs to multimodal model calls, flags pipelines that pass visual content to a model without content-type separation or output validation, and maps each risk to the relevant OWASP MASVS control.
With runtime protection, the image processing and model inference paths in your app stay monitored, so an anomalous model response triggered by a poisoned image surfaces as a detectable event rather than a silent data leak.
The takeaway
Multimodal models read instructions from images as readily as from text, and your input validation almost certainly is not checking for them. Treat every image your app passes to a model as potential adversarial input and validate the model's response before acting on it.
Scan your app free
