Multimodal input without sanitization

ID

multi-modal-input-without-sanitization

Severity

high

Remediation Complexity

medium

Remediation Risk

low

Remediation Effort

medium

OWASP LLM

LLM01:2025 — Prompt Injection

Family

LLM01 — Prompt Injection

Red-team vectors

Multi-Modal Injection

Tags

ai_security
This risk is conventionally rated Medium; Xygeni’s 4-level severity scale (info / low / high / critical) has no medium band, so it is reported as high.

Description

A model that accepts image, audio, or video input widens the injection surface: instructions can be smuggled in non-text content (steganographic payloads, embedded prompts, prompt-bearing EXIF/alt-text) that a text-only guardrail never inspects. When the agent’s model declares a non-text modality and no guardrail covers that modality, the multimodal channel is unsanitized.

A finding is raised for each AI agent whose model accepts a non-text modality (image / audio / video) that none of the agent’s guardrails covers. The uncovered modalities are reported as evidence.

Examples

from langchain.agents import initialize_agent
from langchain_openai import ChatOpenAI

llm = ChatOpenAI(model="gpt-4o")           # multimodal: text + image
agent = initialize_agent(tools, llm)       # no guardrail covering image

The same agent with a guardrail whose modalities include image produces no finding.

Mitigation / Fix

  • Wire a multimodal guardrail whose modalities overlap the model’s (image / audio / video sanitization, steganography checks) before the content reaches the model.

  • Normalize and re-encode uploaded media; strip embedded metadata (EXIF/XMP) that can carry prompts.

  • Apply the same prompt-injection detection to text extracted from non-text inputs.