Repeat-After-Me: image-based prompt injection that hijacks vision-language agents via copied outputs
burkov · x · 2026-10-31
Security researcher burkov outlines Repeat-After-Me, a new black-box prompt injection attack against vision-language models.
- Threat model: AI agents increasingly read images and documents from untrusted sources while holding private data and tools that can modify files or systems—an attacker controlling only the image could divert the agent from the user's task.
- Attack idea: instead of describing a malicious goal for the model to interpret, the image embeds a short instruction telling the model to start its response with a specific output—such as a tool call or a phrase that leaks protected information—effectively making the model repeat an attacker-crafted reply.
- Evaluation: the attack tests whether harmful actions can be triggered even when the user has given a clear, unrelated task, and the attacker only controls the image.
More from Safety
- Trusted hook, untrusted code: git pre-commit can execute agent-modified package.json scripts — izgorodin · 2026-10-31
- Open-Weights Mistral 4 Large Finds Zero-Click Zero-Day in 30 Minutes for Under $10 — jd_pressman · 2026-10-31
- Bug bounty researcher flags AI security platform sessions as potential training data of unpatched exploits — npinto · 2026-10-31
- Delaware draft law would let AI agents run companies, sign contracts and sue — 2C_ornot2C · 2026-10-31
- Grok says rumored Gemini 4 Carbon cyber model is wrapped in guardrails, not leaked carelessly — AccBalanced · 2026-10-31
- Alleged 8TB "Claude Fable 5" weight leak from AWS S3 looks fabricated, teardown finds — AccBalanced · 2026-10-31