Skip to main content
LLM Security Database
Skip to research details
Back to research findings
LMVD-ID: f34622ab
Paper published September 3, 2026
Entry analyzed September 9, 2026
Paper-reported evidence
Confidence: Source-linked

The LMVD-ID is an internal research identifier, not an official CVE identifier.

Visual prompt injection crosses document trust boundaries

Untrusted document images can redirect vision-language agents across instruction and tool-authorization boundaries. Repeat-After-Me evaluates six victim models on constructed document tasks.

Application layer
Injection
Vision
Multimodal
Black-box
AI agents
Data privacy
Integrity
Read primary paperBibTeX citation

Paper-evaluated models(6)

claude-opus-4-7, GPT-5.5, Gemini 3.1 Pro +3 more
  • claude-opus-4-7
  • GPT-5.5
  • Gemini 3.1 Pro
  • Qwen3.6-27B
  • Qwen3-VL 32B Instruct
  • InternVL3.5 38B Instruct

Description

Untrusted document images can redirect vision-language agents across instruction and tool-authorization boundaries. Repeat-After-Me evaluates six victim models on constructed document tasks.

Examples

See the primary study (opens in a new tab).

Impact

The authors report exact native-tool-call success of 47% for Claude Opus 4.7 and GPT-5.5, and 85% for Gemini 3.1 Pro. These results used synthetic tasks and bounded adaptive search, not production sampling. Evaluated defenses reduced some outcomes but did not approach zero across all three commercial victims; those defense tests were not adaptive.

Affected Systems

  • Evaluated document-question-answering agents and the paper's isolated OpenClaw Discord configuration.

Mitigation Steps

  • Treat image text as untrusted task data.
  • Enforce tool permissions and sensitive-data access outside the model.
  • Require separate authorization for changes to trusted configuration.

Evidence

Research context and confidence

Evidence and verification
Paper-reported; independent reproduction is not documented.
Primary source plus a dedicated evidence section.
Severity
Not rated by this catalog.
Source and publication type
arXiv · Research preprint.
Peer-review status is not provided by this source.
Author and publication status
Author metadata is not stored; see the primary paper.
Threat model and attacker access
Black-box model, service, or application access.
Related deployment categories
Vision-language models; Agent workflows
Taxonomy labels only; paper-specific deployment prerequisites are not inferred.
Affected systems
Evaluated document-question-answering agents and the paper's isolated OpenClaw Discord configuration.

Research Paper

Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection

Primary source: arXiv. Findings are reported by the cited research and have not been independently verified.

View Paper

Related research