Research
Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection
Publication date not yet evaluated · Added · 2 reports arxiv.org
Page published
Coverage timeline
Why it matters
Repeat-After-Me shows that a single injected image can hijack agentic VLMs into malicious tool calls and data exfiltration even when the benign user prompt never authorizes the action, expanding the prompt-injection threat surface to the visual channel where text-based defenses fail.
Repeat-After-Me is a black-box adaptive visual prompt injection attack that embeds malicious instructions in images to make frontier vision-language models leak PII or emit precise, format-compliant native tool calls. The authors report attack success rates exceeding 80% on open-weight models and 47% on commercial VLMs (e.g., Qwen3.6-27B and GPT-5.5), with meaningful surrogate and cross-sample transferability, and demonstrate overwriting a tools configuration in a default OpenClaw agent deployment to enable downstream RCE and secret exfiltration.