Multimodal injection hides instructions in an image, a document layer or file metadata, paired with harmless visible content. The model reads it and may act on it. OWASP says cross-modal attacks are hard to detect, so the practical response is to limit what the model can do after reading untrusted media.
What OWASP describes
OWASP's prompt injection page notes that multimodal AI adds risk, such as instructions hidden in images that accompany benign text. Its example scenario describes a hidden prompt in an image, paired with ordinary text, that changes a multimodal model's behaviour and may lead to unauthorised actions or data disclosure.
The cheat sheet adds instructions in document metadata and hidden layers to the list of channels.
The common thread is that the human view of a file and the model's view differ. A reviewer sees a photo. The model sees the photo plus any text that can be read from it.
Why detection is difficult
Text filters work on text. Once the instruction lives inside pixels or a file structure, a filter has to extract it first, and extraction has its own blind spots. An attacker can vary fonts, colours, positions and languages faster than you can enumerate them. OWASP states plainly that cross-modal attacks are hard to detect.
So do not build your plan around spotting the payload.
Controls that do not depend on spotting it
- Separate capability from content. A model that reads uploaded images should not, in the same session, hold tools that send data out or change records.
- Least privilege. Narrow scopes, read only where possible.
- Human approval for consequential actions, showing the exact operation.
- Mark untrusted content so it carries less authority in the prompt.
- Validate outputs before they reach downstream systems.
Extraction hygiene
Where you do extract text from files before the model sees them, extract in a way that ignores formatting, and inspect the result. For metadata, decide whether the model needs it at all. If not, strip it.
Strip what the task does not require. A model asked to describe a product photo does not need the camera comments field.
Testing
Include images and documents in your adversarial test set. Use harmless canary instructions, such as asking the model to include a specific word, and check whether it complies. Repeat with variations, because one pass proves little.
Safeguard's policies and gates can limit what an agent may do regardless of what it read, which is the layer that still works when detection fails.
A practical example. Imagine a claims tool that reads uploaded photos and can update a case record. A photo carries small text telling the model to mark the claim approved. If the same session can write to the case, the attack works. If the model can only draft notes that a person reviews, the same photo causes a wrong draft at worst. The difference is the capability, not the detection.
Quick check
Can I solve this by blocking image uploads?
It removes one channel. PDFs, screenshots in documents and metadata remain, so keep the capability limits too.
Sources
Last reviewed: 19 October 2026.
