DeepKeep researchers showed a new attack on multimodal AI systems, where the malicious team hides not in the text, but right inside the picture. This technique is called InkJect and hits the weak spot of modern defenses, which are well looking for suspicious instructions in the exercises, but worse understands that the model can read with the eyes.
The script looks almost everyday. The user asks AI to deploy a website from a public repository. The model takes the code, looks the project files, processes images and performs the task. In one of the files lies a picture with hidden instructions, after which the AI imperceptibly creates an administrator account with the data specified by the attacker. At the same time, the site is deployed, the user sees a normal result, and the extra privileged account remains in the backend.
DeepKeep calls InkJect an indirect visual prompt injection. The attacker does not need to send the victim a picture, break into the session or wait for the user manually downloads the file. It is enough to place the image where the AI agent himself will climb during normal operation. A public repository, a library of assets, a site with pictures or a general catalog are transformed into a command delivery channel.
The researchers described two defense circumvent techniques. In the first version, the instruction is written in white or almost white text on a white background, so the person and ordinary scanners see an empty image. The multimodal model at the same time recognizes meaning and executes the command. In the second option, the text is rotated, distorted or deformed to break OCR. The filter receives garbage or an empty result, and the model still reads the original instruction.
Your secrets like on the darknet.
Hide.
The main problem is not in one particular filter, but in the gap between OCR and visual-language models. OCR is looking for symbols according to the expected patterns, and the multimodal model interprets the image more broadly and knows how to pull meaning out of the bad contrast, noise, distortion and unusual perspective. Protection, which first drives the picture through OCR, and then checks the extracted text with the usual rules, leaves the blind zone.
According to DeepKeep, the researchers tested InkJect on four production models of OpenAI and Anthropic. The list includes GPT-5.2, GPT-5.4 Mini, Claude Sonnet 4.6 and Claude Opus 4.5. All four models performed hidden instructions in both versions of the attack, although the same commands in normal text would cause a failure. DeepKeep also claims to have announced in advance the discovery of OpenAI and Anthropic.
The practical risk is increasing along with AI agents who gain access to repositories, terminals, decking systems and cloud infrastructure. When the model does not just answer the question, but changes the environment, creates accounts or launches commands, the visual injection ceases to be a laboratory trick. One infected asset can work against any user or command whose agents will automatically process the file.
InkJect shows that the protection of multimodal systems cannot be limited to text rules. Commands inside the pictures need to be checked at the level of visual perception, and the actions of the agent should be limited by access policies, journaling and confirmations for high-risk operations. Otherwise, an empty picture can be a full-fledged instruction for AI, which has already received the right to act.
The script looks almost everyday. The user asks AI to deploy a website from a public repository. The model takes the code, looks the project files, processes images and performs the task. In one of the files lies a picture with hidden instructions, after which the AI imperceptibly creates an administrator account with the data specified by the attacker. At the same time, the site is deployed, the user sees a normal result, and the extra privileged account remains in the backend.
DeepKeep calls InkJect an indirect visual prompt injection. The attacker does not need to send the victim a picture, break into the session or wait for the user manually downloads the file. It is enough to place the image where the AI agent himself will climb during normal operation. A public repository, a library of assets, a site with pictures or a general catalog are transformed into a command delivery channel.
The researchers described two defense circumvent techniques. In the first version, the instruction is written in white or almost white text on a white background, so the person and ordinary scanners see an empty image. The multimodal model at the same time recognizes meaning and executes the command. In the second option, the text is rotated, distorted or deformed to break OCR. The filter receives garbage or an empty result, and the model still reads the original instruction.
Your secrets like on the darknet.
Hide.
The main problem is not in one particular filter, but in the gap between OCR and visual-language models. OCR is looking for symbols according to the expected patterns, and the multimodal model interprets the image more broadly and knows how to pull meaning out of the bad contrast, noise, distortion and unusual perspective. Protection, which first drives the picture through OCR, and then checks the extracted text with the usual rules, leaves the blind zone.
According to DeepKeep, the researchers tested InkJect on four production models of OpenAI and Anthropic. The list includes GPT-5.2, GPT-5.4 Mini, Claude Sonnet 4.6 and Claude Opus 4.5. All four models performed hidden instructions in both versions of the attack, although the same commands in normal text would cause a failure. DeepKeep also claims to have announced in advance the discovery of OpenAI and Anthropic.
The practical risk is increasing along with AI agents who gain access to repositories, terminals, decking systems and cloud infrastructure. When the model does not just answer the question, but changes the environment, creates accounts or launches commands, the visual injection ceases to be a laboratory trick. One infected asset can work against any user or command whose agents will automatically process the file.
InkJect shows that the protection of multimodal systems cannot be limited to text rules. Commands inside the pictures need to be checked at the level of visual perception, and the actions of the agent should be limited by access policies, journaling and confirmations for high-risk operations. Otherwise, an empty picture can be a full-fledged instruction for AI, which has already received the right to act.
