AI agents that read images can be tricked by instructions hidden inside them - but a new benchmark suggests most agents shrug it off.
Researchers built MMPIBench, a testing framework that hides attack instructions in six ways: OCR text, image overlays, EXIF metadata, QR codes, fake interface screenshots, and combinations of these. They ran 720 tests across six agent frameworks, five foundation models, and four attacker goals. The instructions got attempted in 12.8% of runs, but only completed in about 1%. Most of that gap closes at the planning stage, where the model reads the injected text and simply declines to follow it. One model refused every single attempt and caught the injection outright 59.7% of the time. Two others attempted the attacks in 23.6% of runs.
The more interesting finding is buried in the audio results. Only two of the five models and three of the six frameworks even process audio, but when they do, injected instructions succeeded 49% of the time overall, and 75% for one model. That is a completion rate roughly 50 times higher than the image based attacks saw.
This is the tell: defenses get built where researchers look. Vision based prompt injection has drawn attention for a couple of years now, so labs have tuned their models to catch it. Audio is newer territory for agentic tools, and it shows. As more agents gain microphones and speaker access, expect the industry's next scramble to be here, not in image parsing. The paper's headline number - a 1% success rate - is reassuring only if you ignore the channel nobody has hardened yet.