Visual Prompt Injection

Multimodal models read text inside images, and computer-use agents rely on screenshots to navigate. That makes visual content a new channel for injected instructions.

Visual injection techniques include:

• Low-contrast text: Instructions in colors nearly invisible to people.
• Tiny or hidden text: Small print placed in image corners or backgrounds.
• Screenshot traps: Web pages crafted to mislead agents that navigate visually.
• Steganographic cues: Patterns the model interprets but people do not notice.
• Fake interface elements: Images of buttons or dialogs that trick agents into clicking.

Visual injection is especially relevant to agentic browsers and computer-use agents, which act on what they see. A single malicious page or image can redirect an agent operating a user's logged-in session.

Defenses include extracting and inspecting text from images, limiting what agents can do on untrusted sites, and requiring confirmation for sensitive actions.

How PointGuard AI Helps

PointGuard AI AI Runtime Guardrails inspect multimodal inputs for injected instructions, and Agentic Endpoint Security governs browser and computer-use agents on user devices. Policy enforcement keeps visually hijacked agents from completing sensitive actions.

Learn More

• Brave: Agentic Browser Security, Indirect Prompt Injection in Perplexity Comet
• OWASP Top 10 for LLM Applications
• OWASP Top 10 for Agentic Applications