Researchers Reveal Images Can Be Used to Exploit AI Systems

Cybersecurity researchers from Trails of Bits have discovered a new vulnerability in AI systems that allows malicious actors to hide commands within images. The team used a prompt injection strategy to exploit the image downscaling feature in several AI models.

According to the report, published on August 21, the researchers were able to exfiltrate data from multiple AI systems — such as Vertex AI Studio, Gemini CLI, Genspark, Google Assistant, and Gemini’s web and API interfaces — through an image-scaling attack.

“By delivering a multi-modal prompt injection not visible to the user, we achieved data exfiltration on systems including the Google Gemini CLI,” explained the researchers. “This attack works because AI systems often scale down large images before sending them to the model: when scaled, these images can reveal prompt injections that are not visible at full resolution.”

The document provides more details on how image scaling can be exploited in AI systems, outlines mitigation strategies, and introduces Anamorpher — an open-source tool that enables the crafting and visualization of such attacks.

Trails of Bits demonstrated the attack’s effectiveness using Google’s open-source AI agent Gemini CLI. The experts showed that with the default Zapier integration enabled, a user could upload an apparently harmless image that, once processed, silently triggered Zapier to send the user’s Google Calendar data to an attacker’s email without any warning or confirmation.

The researchers recommend that developers avoid image downscaling where possible and instead restrict upload dimensions. If downscaling is necessary, they suggest always displaying a preview of the image that the model will process.

Anamorpher, currently released in beta, can generate crafted images using different scaling methods to demonstrate attacks and help other researchers develop defenses against this vulnerability.

Concerns about vulnerabilities in AI systems continue to grow. A few days ago, researchers at NeuralTrust revealed that OpenAI’s latest AI model GPT-5 is susceptible to attacks.