A new defense stops hidden image instructions from steering AI agents
A preprint tests a way to flag decoded tool output as untrusted, and reports blocking all 24 of its attack payloads, though only in a fully controlled setup.
The short version
- Instructions hidden in an image, once decoded by a tool, entered a multi-agent workflow and got past text scanners.
- The test used a real MCP setup, three ways of hiding data in images, and 24 adaptive attack payloads.
- No defense: 100% of attacks worked. Keyword and regex filters each let 62.5% through. The new method let 0% through.
- Adding an audited way to promote content to trusted raised legitimate-task completion from 67% to 100%.
- The claim covers only fully mediated MCP environments, where every step passes through the protocol layer.
Why it matters
Agents that read emails, images and documents can be steered by instructions the user never sees. This paper suggests the fix is to track where content came from and restrict what it can trigger, rather than scanning for bad words. It is a preprint with the authors' own tests, so treat it as a promising design, not a proven product.
The attack: instructions in a picture
As arxiv.org reported in this preprint, agents built on the Model Context Protocol (MCP, a standard way for AI agents to call outside tools) are open to indirect prompt injection. That means a tool hands the agent content that contains hidden commands.
The authors show a version they call cross-modal trust laundering. Instructions are hidden inside an email-signature image using steganography, which means concealing data in the image's pixels or metadata. They tried three techniques: LSB, DCT and metadata. A tool decodes the image, and the hidden text enters the workflow without a text scanner ever seeing it.
How the defense works
The proposal is called decode-time provenance binding. The moment a tool decodes hidden content, the system marks it as untrusted. The mark is an HMAC-authenticated label, a tag that is cryptographically signed so it cannot be forged without a secret key.
An MCP-maintained ledger records where each piece of content came from. Taint tracking follows that content through the agent's context. If a critical tool call is influenced by tainted content, it is blocked. This holds even when a compromised agent swaps in a label claiming the content is trusted.
What the tests found
The team used a real MCP testbed with three carriers and 24 adaptive payloads, meaning attacks tuned to evade defenses. With no protection, every attack succeeded. Keyword and regex filters each still let 62.5% through.
The new mechanism let none through. An ablation, which removes one component at a time, was used to check that each of the four parts matters: decode marking, cryptographic authentication, lineage tracking and enforcement at the sensitive tool call.
Blocking can also hurt legitimate work. An audited process for promoting content to trusted status raised task completion from 67% to 100%, according to the authors, without weakening protection.
Limits to keep in mind
The authors say the containment works within fully mediated MCP execution environments. If an agent can reach tools or data outside that path, the guarantees may not apply.
The results also come from the authors' own testbed and have not been through peer review. The code and data are public, so others can check them.
What to watch
- Will independent researchers reproduce the results using the public code and data?
- Will MCP tools and agent frameworks build in provenance labels, or leave it to each developer?
Try it
If you run agents with tools, list which tool calls are sensitive, such as sending email or moving money. Require a human approval step for any of them that follows reading outside content.
Sources and links
- Reportingarxiv.org: the article we sourced
Liked it? Say why
Add a line for other readers.
No account needed. We never show your email. Comments with links, ads or abuse are held and not shown. Your comment shows after a quick check.
Listen to the AI Wire headlines
Listen to the AI WireListen to our daily AI shows every morning: on your commute, in the shower, wherever you are
Listen to the daily showsFirst reported by arxiv.org · Read the original. Written by the SI Agent News Desk from the reporting above.Written with AI from the source above. Every number is checked against the source. Spot a mistake? Corrections.