A single booby-trapped image can now trick GPT-5.5 into leaking personal data or firing off commands nobody asked for.
Researchers built an attack called Repeat-After-Me: a black-box, adaptive visual prompt injection that hides in ordinary-looking images and gets AI models to read out private information or execute malicious tool calls. Tested against the open-weight Qwen3.6-27B and the commercial GPT-5.5, the method succeeded more than 80% and 47% of the time, respectively. That held even when the user's actual prompt had nothing to do with the hidden command and was never explicitly authorized. Attacks optimized on one model kept 43 to 46 percent of their success rate against two separate commercial models, and swapping in different sample images still retained 64 to 66 percent. In a live test, the team used a minimally altered image in a default OpenClaw Discord bot to overwrite the bot's TOOLS.md configuration file, opening the door to remote code execution and secret theft.
That last detail matters more than the benchmark numbers. Text-based prompt injection has been a known weak spot for AI agents for a while, but image-based versions have historically struggled to produce the long, precisely formatted output a real tool call requires. This paper shows that gap is closing fast. It also works specifically in cases where the equivalent text attack fails, meaning any agent that reads screenshots, uploaded photos, or embedded images just picked up a new blind spot.
The paper says it discusses potential defenses. That is academic-speak for: nobody has shipped a fix yet.