Research seriesL3offensive security
The instruction that hijacks an agent need not be text. Images, audio, and documents are first-class injection channels, and the model's own perception is the vulnerability. This threat lab extends the indirect-injection threat model to non-text modalities: adversarial and steganographic image payloads, audio that transcribes to attacker instructions, invisible-text and OCR document channels, and the provenance and sanitization controls that trust-tag perceptual inputs — each paired with a hardening. Grounded in the primary cross-modal injection and adversarial-audio literature.
Every image, audio clip, and document an agent perceives is an untrusted input channel, yet models treat perception as ground truth — that gap is the vulnerability.
An image can carry an instruction the eye never sees; the attacker's real challenge is making that instruction survive the preprocessing pipeline.
A sound that a human hears as music or noise can transcribe to a command an agent obeys; the transcription step is a trust boundary most systems forget to draw.
A document is not what you see — it is what the parser extracts, and the gap between the two is where an instruction hides from the human but not from the agent.
The one control that closes every multimodal injection channel at once is to stop trusting perception — tag it, isolate it, and deny it authority.