For about three years, security teams have worked to shut down prompt injection, and the effort paid off. Input classifiers, pattern detection, and content filters now catch a real share of malicious instructions before they reach a model, though that protection was never a property of the model itself. Security teams built a scanning layer and placed it in front of the model, because a capable model will not reliably refuse a malicious instruction on its own. And they aimed that layer almost entirely at the text a model reads.
While that work concentrated on text, the workload moved somewhere else. A large share of enterprise AI now uses vision-language models (VLMs), systems that read invoices, screenshots, scanned PDFs, and video alongside typed prompts. So the defense and the exposure drifted apart. A poisoned image needs no password and no user session, and it can reach every workflow that touches it. Enterprises never pointed the guardrail layer that inspects text at what a picture contains.
The reason this drift matters is scale, not novelty. Gartner projects that 40% of generative AI solutions will be multimodal by 2027, up from 1% in 2023, so the image channel is on its way to becoming the main channel, but security architecture has not kept pace. Another 2026 CISO AI Risk Report found that 71% of security leaders said AI already reaches core business systems, and only 16% said they govern that access effectively. The capability outran the controls, and images are where the gap runs deepest.
To see why images slip through, it helps to look at how these attacks actually arrive. Prompt injection first became known as a risk for LLM applications, and it comes in two forms. In a direct attack, a user types a malicious instruction into the system. In an indirect attack, the instruction rides in on content the model retrieves on its own, such as a webpage, a document, or an image sitting in a shared repository. Text defenses grew up around the direct kind and a slice of the indirect kind, so they cover a narrower part of what a model reads than most security teams assume.
What makes the indirect path so easy to miss is that it looks like ordinary work. An enterprise chatbot reads an uploaded invoice. A coding assistant pulls in a screenshot to debug an interface. An agent browsing the web takes in the images on every page it visits, and a support tool ingests a customer’s attached photo. To a security team, none of that looks like a prompt, so nobody built a guardrail around it. Send a suspicious instruction into that chatbot as plain text and the scanning layer often catches it and blocks it. Hide the same instruction inside a picture the model reads, and the layer usually never looks, because the scrutiny built for typed text has not caught up to everything a modern model can see.
The danger runs deeper than a single tricked chatbot. Because the malicious content arrives through retrieval, the attack needs no targeted user, no live session, and no stolen credential. All it requires is a poisoned asset sitting somewhere a VLM will fetch on its own, whether a shared repository, an image library, or a scraped webpage. And one such image can reach every user and every agent whose workflow touches it, which turns a single planted file into a supply-chain problem hiding inside normal model behavior. Shadow AI widens that surface further, since 75% of organizations in the same 2026 report had already found unsanctioned AI tools running in production, often reaching content no one reviews.
What makes it worse is how quiet it stays. A visual injection can produce a result that looks correct while nothing gets flagged or reviewed. The task the user asked for gets executed, and a second, unauthorized action runs alongside it, with the only copy of that instruction sitting inside a picture nobody examined closely. A normal breach tends to announce itself, but this kind has no reason to. And most enterprise risk assessments make that silence easy to keep, because they still ask about model alignment and text-input filtering and almost never ask what happens when the same model reads a picture. The gap is a governance failure as much as a technical one.
Closing it begins with a decision rather than a purchase. A security team can treat “the model looked at a picture” as a loggable, reviewable event today, without waiting for an incident and without buying new architecture. From there, the same questions teams already apply to text carry over to every image a model reads, so someone logs where the image came from, verifies its source, and reviews what the model produced before that output ships. As AI systems take on more of the real work, reading documents, browsing pages, and looking at what people hand them, the meaning of the word “input” has to widen to match. The organizations that make that adjustment before an incident forces them will set the standard, and they will keep their systems protected while everyone else still scans half of what their models see.
Join our LinkedIn group Information Security Community!