Abstract

Visual prompt injection (VPI) is less well understood, yet the risk is important to understand, because modern agents increasingly rely on vision-language models (VLMs) to interpret screenshots, receipts, forms, and document images [12, 26, 34]. There has been extensive research into attacks on VLMs [24, 6, 9, 10, 13, 15 18, 22, 24, 30, 3638, 40, 42, 44, 46]. However, our evaluation shows existing visual prompt injection attacks are substantially less effective at attacking a black-box VLM and eliciting materially harmful behaviors . Because practical VPI attacks are challenging, prior work makes simplifying assumptions that may not be realistic in practice, e.g., assuming the user prompt is missing, generic, or attacker-controlled, so the malicious image does not need to compete with a real benign task [6, 10, 13, 1518, 22, 24, 30, 37, 38, 42], or requiring white-box access to the victim model, which is unavailable for commercial systems [24, 9, 40]. Most prior attacks aim at eliciting simple target responses, such as a single word, a short phrase, or a semantically biased response [6, 10, 13, 15 17, 24, 30, 37, 38, 42, 44, 46], rather than a long and structured output that is required for a harmful action. In a realistic agent setting, the attackers image must override a benign task and induce an attacker-chosen outcome that is materially harmful, such as a native tool call or disclosure of protected context. That combination turns out to be substantially harder than prior work suggests [2, 4, 22, 40] (see Section 2.1). Prompt injection is widely recognized as a major security threat to AI agents that interact with untrusted external data, such as websites, documents, and emails. In the image domain, however, existing visual prompt injection methods are substantially less effective in attacking frontier commercial VLMs for materially harmful behavior. Achieving such outputs is hard because it requires a long and/or format-compliant target string, such as a precise, parseable native tool call with exact function names and arguments. We present Repeat-After-Me, a black-box adaptive visual prompt injection attack that can reveal personally identifiable information or make malicious tool calls. Across both open-weight and commercial frontier VLMs, including Qwen3.6-27B and GPT-5.5, our method achieves ASRs exceeding 80% and 47%, respectively, under a realistic setting in which the benign user prompt is semantically unrelated to the injected task and does not verbally authorize it. In our evaluation, injections optimized on one surrogate retain 4346% of the original ASR on two commercial victims, and cross-sample transferability retains 6466% of the original ASR on those two models. We test our attack in a real-world OpenClaw agent: in a default OpenClaw Discord deployment, an untrusted user can use a minimally injected image to overwrite TOOLS.md, enabling future sensitive behaviors like remote code execution and secret exfiltration. We show our new attack vector works in cases where adaptive textual prompt injection fails. We discuss potential defenses.