Multimodal prompt injections on AI agents succeed 1% via images, 49% via audio.

AI agents are programs that can plan tasks, remember information, and use real-world tools like email. Many of these agents can also see pictures. This creates a danger: an attacker can hide secret commands inside an image to hijack the agent without the user knowing. Researchers created a benchmark called MMPIBench to test this threat. They hid instructions inside images using tricks like hidden metadata, fake computer interfaces, and text overlays, then tracked if the agents followed them. They found that attacks fully succeeded in approximately 1% of runs, but agents tried to execute them in 12.8% of runs. The gap exists because models often notice the hidden command during planning and choose not to act. The underlying AI model mattered much more than the agent framework. Finally, tests using audio were far more dangerous: whenever agents could actually hear the sound, the attacks fully succeeded almost half the time.

Why it matters

As AI agents gain access to files, email, and services, attackers can hide instructions in images or audio to hijack them. This benchmark shows that while vision-based attacks are often caught, audio attacks are far more dangerous. Developers need to defend all perceptual channels, not just text.

Questions answered