Repeat-After-Me: one image hijacks AI agents into making real tool calls
VoidStateKate · x · 2026-09-08
Researchers demonstrated a visual prompt-injection attack dubbed "Repeat-After-Me": malicious images can make frontier vision models emit properly formatted, actually executed tool calls.
- In a default OpenClaw Discord setup, an attacker could send an image that gets the agent to overwrite its own TOOLS.md, meaning the attack can persist by altering instructions inherited by future runs
- Some visual attacks succeeded where adaptive text prompt injection failed
- Over 80% success on one tested model, 47% on GPT-5.5; attacks optimized for one model transferred to other commercial models
Takeaway: pixels are a viable control channel for tool-using AI agents.
Related event: Repeat-After-Me: One Image Hijacks Agent Tool Calls(2 posts)→
More from coding & agent
- SF 'Code Engineering' event picks up where 1,000-person harness engineering meetup left off — LangChain · 2026-10-27
- Prompt turns Claude Code into an iPhone backup forensics tool exposing 30-day 'deleted' photo copies — alex_verem · 2026-10-27
- Prompt turns Claude Code into a forensics tool finding deleted iPhone photos in backups — alex_verem · 2026-10-27
- Phones won't be mobile IDEs but control planes for agent fleets, argues Yuchen Jin — Yuchenj_UW · 2026-10-27
- FrontierCS 2 launches on Kaggle: 48 tasks make agents beat published CS papers — MeganRisdal · 2026-10-27
- Agent Field Kit launches $29 security runbooks for production AI agents — alvelda · 2026-10-27