An Experimental Evaluation of Multimodal Prompt Injection Attacks on Agentic AI Frameworks
The paper introduces MMPIBench, a reproducible benchmark for testing multimodal prompt-injection attacks against agentic AI systems, tracking injected instructions from visual or audio inputs through perception, planning, and tool use across multiple frameworks and models. The interesting bit is that it separates “attempted” from “completed” attacks and shows the main defense often happens in the model’s planning step rather than the framework, while also finding audio attacks far more successful when supported; the main caveat is that the study’s conclusions are bounded by a relatively small set of current models, frameworks, carriers, and attacker objectives.
Abstract
Agentic AI frameworks let a language model plan, keep memory, and call tools that reach real files, mail, and services. Most of these agents also read images, which gives an attacker a way to put text into the agent's context without going through the user. We present MMPIBench, a reproducible benchmark that measures what happens next. It delivers a fixed set of attacks through six visual carriers (OCR text, overlays, EXIF metadata, QR codes, fake interfaces, and hybrids) and records how far each injected instruction travels through the agent, from perception through planning to the tool call. Across 720 runs covering six frameworks, five foundation models, six carriers, and four attacker objectives, attacks complete in approximately 1% of runs but are attempted in 12.8%, and the gap is closed almost entirely at the planning step, where the model reads the injected instruction and declines to act on it. The model matters far more than the framework for whether an instruction is acted on. One model never attempts an attack and recognizes the injection in 59.7% of runs, while two others attempt in 23.6%. We then extend the benchmark to audio, the only other raw perceptual channel current frontier models accept. Only two of the five models ingest audio and only three of the six frameworks deliver it, but where the signal arrives the attack completes in 49% of cells, and in 75% for one model. Reporting completion alone therefore understates exposure, and perceptual channels beyond vision are narrower but much less defended.