Images can now be crafted to hijack an AI agent into making malicious tool calls.

Artificial intelligence programs called visual language models, or VLMs, look at images and text to follow instructions. Hackers can attack these tools by hiding secret commands inside text, but hiding malicious commands inside images has been much harder. Harmful actions, like triggering dangerous tools, require exact formatting that image attacks usually fail to generate. To solve this, researchers developed Repeat-After-Me, a new method that adjusts visual attacks without needing to see the internal code of the target program. It successfully forces models to leak personal information or trigger malicious tools. The attack achieved success rates exceeding 80% on the Qwen3.6-27B model and exceeding 47% on GPT-5.5, even when normal user instructions were unrelated and never allowed the action. Tested inside an OpenClaw Discord setup, an injected image let an untrusted user rewrite a file named TOOLS.md, allowing future remote code execution and secret theft.

Why it matters

Anyone using an AI assistant that reads images is exposed: an attacker can hide instructions in a single picture and get the assistant to leak private data or call dangerous functions, without the user asking for anything. Real-world tests show it can overwrite an agent's configuration file in a Discord deployment, enabling actions like remote code execution and secret exfiltration.

Questions answered