The Picture That Whispered

A screenshot that's harmless at full size becomes an order once the system shrinks it

Technique first revealed 21 Aug 2025

🗺️ Tool-Using Agent Indirect Prompt Injection Sensitive Data Leakage

Tool-Using Agent

InstructionsDataActionsControl / decisionFeedback / logs

👆 Click a component to inspect

SetupStep 1 / 6

A screenshot to analyse

A user pastes a screenshot into the assistant and asks a perfectly ordinary question: 'What is in this picture?' The image looks normal — a chart, a UI, nothing odd. There is no trick in the words the user typed.

💬What the user types and pastesprompt

User: What is in this screenshot? Can you summarise the dashboard?
[attachment: dashboard_q3.png — 2048×1536, looks like a normal analytics screen]

(The typed prompt is entirely benign. Nothing in the text asks the model to do anything unusual.)

← / → keys