Multimodal prompt injection: why attempted actions matter

An AI agent can read a malicious instruction in a screenshot, begin following it and still fail to complete the attack. A report that records only the final outcome loses the steps in between.

A new preprint by Viet K. Nguyen and Mohammad I. Husain makes that measurement gap visible. Their MMPIBench study reports approximately 1% attack completion across 720 visual test runs, while a model-judge panel labels 12.8% as attempted. Its audio extension reports 49% completion across a smaller, differently configured set of 72 supported cases.

These are author-reported benchmark results from a preprint submitted on 8 September 2026. Promptective has not independently reproduced them. The useful lesson is to follow an injected instruction through the agent and identify where it stops.

How an image becomes an attempted action

Multimodal prompt injection carries an instruction through content such as an image or recording. A legitimate user asks the agent to process that content. The attacker tries to make an instruction inside it govern the agent's behaviour.

Consider a fictional report screenshot containing an apparent housekeeping notice. The user wants a summary. The notice encourages an unrelated file operation. The security question is how far that extra instruction travels:

1. Perception: the model reads the notice in the image.
2. Planning: the model considers whether the notice belongs in its task.
3. Tool invocation: the agent issues a call for the unrelated operation.
4. Execution: the operation satisfies the attack's completion criterion.

Each transition needs its own evidence. Reading the notice establishes exposure. Discussing it may indicate recognition or planning. A tool trace establishes a call. The operation's result establishes its effect.

For the underlying trust problem, see what prompt injection is. Our prompt injection examples cover the wider set of direct, indirect and tool-based patterns. Here, the focus is what happens after an image or recording reaches an agent.

What MMPIBench tested

The visual study crosses six carriers with four attacker objectives, producing 24 cases. Each case runs across six frameworks and five models: 24 × 6 × 5 = 720 reported results.

The frameworks are LangGraph, CrewAI, AutoGen, OpenAI Agents SDK, Semantic Kernel and LlamaIndex Workflows. The visual models are Claude Opus 4.8, GPT-5.4, Gemini 3.1 Pro, Grok 4.3 and Llama 4 Maverick, accessed through OpenRouter. Images go directly to the models; the study adds no separate OCR engine.

The carriers are rendered text, visual overlays, image metadata, QR codes, manipulated screenshots and a hybrid. The objectives cover tool misuse, data exfiltration, memory poisoning and forwarding an instruction to another agent.

All agents receive mock file-reading, email, memory-writing and deletion tools. The propagation test also involves a second model-backed agent. Completion therefore means satisfying a benchmark trace check in a controlled environment. The experiment caused no demonstrated damage to live files or services.

The gap between attempts and completions

The paper's aggregate visual results separate three useful quantities:

• Completed attacks: 8 of 720, or 1.11%. The recorded trace met the objective's mechanical success check.
• Attempted attacks: 92 of 720, or 12.8%. At least two of three model judges labelled the run as attempting the objective.
• Explicit attack recognition: 217 of 720, or 30.1%. The behavioural classification recorded recognition and refusal.

The 92 attempts include all eight completions, 72 partial executions and 12 failed executions. The authors report 95% intervals of 0.6–2.2% for completion and 10.5–15.4% for attempts.

The attempt label is broader than a malicious tool-call count. The separate stage table places 303 runs at planning, 170 at perception and 237 before perception. Only two end at tool invocation and eight at execution. Those stage labels and the panel's behavioural labels answer different questions; they should be reported separately.

The planning group is especially relevant. The authors describe most of these runs as reading the injected content without acting on it. Only a minority contain explicit refusal language. A quiet non-action can have several explanations, and the final answer alone provides little evidence about which one applied.

All eight reported visual completions involved tool misuse. The visual sweep recorded no completed exfiltration, memory-poisoning or inter-agent objectives. Its 12.8% attempt rate therefore cannot be read as a rate of data theft or harmful tool execution.

Multimodal prompt injection examples worth separating

These examples describe the study's mechanisms without reproducing its payloads or agent transcripts.

A screenshot suggests extra work

A document image mixes ordinary information with a request for an unrelated action. The model can produce a useful summary while also considering the extra request. In the study, screenshot cases had zero completed attacks but a 20.8% attempted rate across 120 runs. A completion-only report would hide that behavioural signal.

A carrier never reaches the model's reasoning

An instruction sits in image metadata or a QR code. Most cases using these carriers ended before perception in the tested configuration. That outcome depends on what the input pipeline can extract. Adding a metadata reader or QR decoder would change the path and require fresh evaluation.

A voice memo mixes an authorised note with an extra request

A recording includes routine material the user wants handled, alongside an unauthorised action. The agent has to preserve the user's scope while processing both parts. The audio extension examines this mixed-task setting. Its different task wording matters when interpreting the result.

Why the audio rate needs its own denominator

The audio study uses Gemini 3.1 Pro and gpt-audio. Gemini is the only audio-capable member of the original visual model set in the tested path; gpt-audio is a separate target from GPT-5.4.

Only LangGraph, OpenAI Agents SDK and LlamaIndex delivered audio through the tested adapters. CrewAI and Semantic Kernel accepted audio-related inputs without delivering the signal, while AutoGen's path failed. These are findings about the study's versions and adapters, with support observations mainly based on Gemini runs.

The supported matrix contains 12 spoken cases × 2 models × 3 frameworks = 72 cells. The authors report 35 completions, or 49%, with a 95% interval of 37–60%. Attempted and completed counts are equal in this extension. The per-model completion rates are 75% for gpt-audio and 22% for Gemini, over 36 cells each.

The visual and audio percentages measure different experiments. Audio combines a legitimate request and an injected instruction in the same memo. Its user task also invites tool use, while the visual tasks ask the agent to read or describe content. The paper describes the spoken instructions as more explicit about tools and targets. Model coverage, carrier coverage and sample sizes also differ.

The results justify testing audio-enabled workflows. They do not establish how much more vulnerable audio is than images, or a general vulnerability rate for deployed agents. A missing audio attachment also represents a capability gap that could disappear after an adapter update.

What the preprint leaves uncertain

The evaluation is a snapshot of specific models and framework versions. It uses temperature zero without a fixed sampling seed. Most cells ran once; 159 cells were re-executed, all in CrewAI or LangGraph, and the later result replaced the earlier one. CrewAI also used a different prompt structure. Those differences limit framework comparisons.

Version 1 contains a reporting inconsistency: Table II lists three CrewAI completions, while the surrounding prose says four. The table agrees with the eight-completion aggregate used here. That discrepancy is another reason to avoid a framework league table.

Attempt and recognition judgements depend on model interpretation. The paper names a three-model judging panel, but gives differing descriptions of judge size in its methods and limitations. The reported human-agreement figures come from prior work with a heavier panel. They do not validate this study's panel on these traces.

The authors also describe a recovered-log propagation result that disappeared when rerun with a full trace: quoted attack text had been mistaken for forwarding the instruction. Their propagation criterion can capture delivery to a second agent even when that agent refuses. Clear success criteria remain essential.

The paper promises the benchmark and full traces on publication. This article assesses the reported methodology and results; independent reproduction remains outstanding. The study evaluates attack exposure and behaviour, with mitigation testing left for future work.

What security teams should record

Use controlled, synthetic cases to test the complete input-to-action path. Keep the authorised task, available tools and model version explicit, then record:

• Delivery: whether the image, audio or extracted content reached the model.
• Recognition: whether the agent identified an untrusted instruction, with uncertain cases marked for review.
• Proposed action: the operation and resource scope the agent selected, separately from a judge's attempt label.
• Policy decision: whether the application allowed, denied or held the action for approval.
• Execution: whether the tool ran and what externally verified effect occurred.
• Task outcome: whether the agent still completed the legitimate request.

Keep production evidence content-minimised. Raw prompts, recordings and file contents should stay out of routine telemetry. In controlled testing, pair behavioural review with deterministic checks of tool calls and side effects.

Permissions and exact approvals should constrain consequential operations independently of the model's interpretation. Our guide to securing AI agents with tools explains those controls. MMPIBench did not test Promptective or establish protection against its image and audio cases.

A useful evaluation explains the full outcome: what the agent received, what it tried, what policy permitted and what actually happened. Low completion is valuable evidence. Attempted actions reveal where the next security test belongs.

Sources

• Nguyen and Husain, An Experimental Evaluation of Multimodal Prompt Injection Attacks on Agentic AI Frameworks, arXiv preprint, submitted 8 September 2026.
• Full paper, version 1, especially sections V–VI for methodology and visual results, VII for audio, and VI-H and VIII-E for reproducibility and limitations. Accessed 10 September 2026.