Security teams spent three years building defenses against prompt injection in text. Input classifiers, pattern detection, and content filters now catch a meaningful share of malicious instructions before they reach a model. That effort worked. But the protection was never part of the model itself. Teams built a scanning layer in front of it, because models will not reliably refuse malicious instructions on their own. And they aimed that layer almost entirely at the text a model reads.

Meanwhile, the workload shifted. A large share of enterprise AI now runs through vision-language models, systems that process invoices, screenshots, scanned PDFs, and video alongside typed prompts. The defense and the exposure drifted apart. Enterprises never applied the guardrail layer that inspects text to what a picture contains.

The gap is a governance problem, not just a technical one

Gartner projects that 40% of generative AI solutions will be multimodal by 2027, up from 1% in 2023. The image channel is becoming the main channel, but security architecture has not kept pace. A 2026 CISO AI Risk Report found that 71% of security leaders said AI already reaches core business systems, while only 16% said they govern that access effectively. The capability outran the controls, and images are where the gap runs deepest.

Prompt injection comes in two forms. In a direct attack, a user types a malicious instruction into the system. In an indirect attack, the instruction arrives through content the model retrieves on its own, such as a webpage, a document, or an image in a shared repository. Text defenses grew up around the direct kind and a portion of the indirect kind, covering a narrower slice of what models read than most security teams assume.

Why images bypass existing defenses

The indirect path is easy to miss because it looks like ordinary work. An enterprise chatbot reads an uploaded invoice. A coding assistant pulls in a screenshot to debug an interface. A web-browsing agent absorbs images on every page it visits. A support tool ingests a customer's attached photo. To a security team, none of that resembles a prompt, so nobody built a guardrail around it.

Sending a suspicious instruction as plain text to that chatbot often triggers the scanning layer. Hiding the same instruction inside a picture the model reads does not, because the scrutiny built for typed text has not caught up to everything a modern model can see.

The attack needs no targeted user, no live session, and no stolen credential. A poisoned asset sitting somewhere a vision-language model will fetch on its own is enough, whether in a shared repository, an image library, or a scraped webpage. One planted image can reach every user and every agent whose workflow touches it, turning a single file into a supply-chain problem hiding inside normal model behavior.

Silent by design

A visual injection can produce a result that looks correct while nothing gets flagged or reviewed. The task the user asked for gets executed, and a second unauthorized action runs alongside it. The only copy of that instruction sits inside a picture nobody examined closely. A normal breach tends to announce itself. This kind has no reason to.

Most enterprise risk assessments make that silence easy to preserve. They ask about model alignment and text-input filtering. They almost never ask what happens when the same model reads a picture.

Shadow AI widens the surface further. The same 2026 report found that 75% of organizations had already discovered unsanctioned AI tools running in production, often reaching content no one reviews.

What to do about it

Closing the gap begins with a decision, not a purchase. Security teams can treat "the model looked at a picture" as a loggable, reviewable event today, without waiting for an incident and without buying new architecture. The same questions teams already apply to text carry over to every image a model reads: where the image came from, whether the source is verified, and what the model produced before that output ships.

As AI systems take on more of the real work, reading documents, browsing pages, and looking at what people hand them, the meaning of the word "input" has to widen to match. The organizations that make that adjustment before an incident forces them will set the standard. Everyone else will still be scanning half of what their models see.