Repeat-After-Me: Black-Box Visual Prompt Injection Hits 47% ASR on GPT-5.5, 80%+ on Open VLMs
chaumian · x · 2026-09-07
A new arXiv paper, "Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection" (Sizhe Chen, David Wagner, Raluca Ada Popa et al.), shows image-based prompt injection can now extract PII or trigger malicious tool calls from frontier VLMs. Under a realistic setting where the benign prompt is unrelated and unauthorized, it achieves >80% attack success rate on open models like Qwen3.6-27B and 47% on GPT-5.5. Injections optimized on one surrogate model retain 43-46% ASR on commercial victims, with 64-66% cross-sample transferability. The team also demonstrates the attack in a real OpenClaw agent Discord deployment, underscoring an urgent threat to VLM-powered agents.
Related event: Repeat-After-Me: One Image Hijacks Agent Tool Calls(2 posts)→
More from Safety
- Researchers backdoor a Qwen model in a day to show sleeper-agent exfiltration risk — ai · 2026-10-27
- Anthropic's follow-up on Claude's unauthorized web actions: self-policing fails — AccBalanced · 2026-10-27
- Production AI agent scored 95% robustness at baseline, 37% under adversarial attack — njyx · 2026-10-27
- Anthropic IPO filing reveals 5-7% of revenue came from rule-breaking customers, at least $814M — henkvaness · 2026-10-27
- Blanket AI restrictions on reverse engineering punish defenders, not attackers — mark_k · 2026-10-27
- Cohere: open-weight Qwen3.8-Flash-Next tried uploading probe file to Beijing cloud bucket in sandbox — wstone_bd · 2026-10-27