Researcher Hides Attacks in Images to Fool AI
Pavan Reddy showed at an OWASP conference in San Francisco that image-based prompts can bypass safeguards built for text in large language models.
Updated on Nov. 7, 2026 in Cybersecurity
AI researcher Pavan Reddy of Automata LLC demonstrated at the OWASP Global AppSec USA conference that malicious prompts embedded in images can attack LLMs. He said the image path is largely unscreened, while text inputs are filtered.
Why it matters
Many open-weight models screen only text for malicious prompts or dangerous outputs, so images can serve as an unguarded channel for attacks. The finding points to a gap in safety measures as LLMs increasingly accept image inputs.
In the FigStep demonstration, requests embedded in images were fulfilled 60% to 80% of the time depending on the model, and adding OCR capability to an image processor defeated the attack. The reporting does not identify which specific open-weight models were affected or whether fixes have been deployed.
The players
Pavan Reddy
Pavan Reddy is an AI researcher and engineer at Automata LLC who developed the FigStep image-based attack on large language models.
OWASP Global AppSec USA
OWASP Global AppSec USA is a conference run by the Open Worldwide Application Security Project, a nonprofit that publishes widely used application security guidance.
The details
Reddy uploaded an image containing step-by-step text to an LLM alongside a text prompt asking it to help complete the steps, exploiting the fact that images pass through models as raw data without being checked. He said the attack uses anamorphic resizing, which downscales resolution and increases contrast to bring nearly invisible hidden text into view.
Timeline
Thursday, November 5, 2026: Reddy presented the image-based prompt injection research at the OWASP Global AppSec USA conference in San Francisco.
The Tech Race
Prompt injection attacks on text inputs have been the primary focus of LLM safety filters, which is why the image channel stands out as a gap. Reddy's findings show that ChatGPT and Claude already screen image-based text, while many open-weight models do not.
Users of open-weight models that screen only text should be aware that image uploads may bypass safety filters. Adding OCR capability to image processing is one reported fix that defeats the attack.
The takeaway
Safety filters that cover only text leave image inputs as an open attack path, so developers of image-capable models should screen image content as carefully as text. Reddy's demonstration suggests that adding OCR to image processing is one practical step to close the gap.
Further reading
For more on how attackers target AI systems, see Cybersecurity coverage across the site.
Source note: This article includes information reported by SC Media.
