A red-team framework called MemJack can jailbreak vision-language models using nothing but ordinary photographs.
Researchers built a multi-agent pipeline that automatically turns benign, unmodified images - the kind found in the standard COCO dataset - into reusable "attack anchors" for getting vision-language models to ignore their own safety rules. The system runs a closed loop: it finds a visual anchor in an image, camouflages harmful intent around it, evaluates the model's response, repairs failed attempts, and replans until the jailbreak lands. Tested against Qwen3-VL-Plus, MemJack hit a 71.48% attack success rate, climbing to 90% with extended budgets. The team also used it to build MemJack-Bench, a dataset of more than 113,000 jailbreak conversation trajectories for other researchers to study.
Most jailbreak research assumes attackers need adversarial noise or images specially doctored with hidden instructions. MemJack shows plain, publicly available photos are enough, which is a harder problem for defenders because there is no obviously poisoned pixel pattern to filter out. That is a more practical threat than lab demos relying on imperceptible pixel tweaks, since it works with images anyone could pull off the open web.
A 90% success rate against a safety-aligned commercial model is a reminder that current alignment training still recognizes known attack shapes far better than the much larger space of ordinary images that can be repurposed against it.