New AI attack hides data-theft prompts in downscaled images

Researchers at Trail of Bits have unveiled a novel attack vector that exploits image downscaling vulnerabilities in AI systems, enabling the injection of malicious, human-invisible prompts into images that become readable by large language models (LLMs). This technique, demonstrated against platforms including Google Gemini and Vertex AI, allows for covert data exfiltration, such as Google Calendar data, by tricking AI models into executing hidden instructions without user knowledge. The discovery highlights a significant and widespread security risk in multimodal AI applications, underscoring the urgent need for robust mitigation strategies like dimension restrictions, user previews, and explicit user confirmations for sensitive tool calls to prevent data leakage and unauthorized actions.

Analysis

A significant cybersecurity vulnerability has been identified by Trail of Bits researchers, exposing a novel attack vector against multimodal large language models. The method leverages image downscaling algorithms—a standard process for performance and cost efficiency in AI systems—to inject malicious, human-invisible prompts into images. When processed, these prompts become machine-readable commands, enabling unauthorized actions such as data exfiltration. The research explicitly confirms the feasibility of this attack against several key Alphabet (GOOGL, GOOG) products, including the Gemini CLI, Vertex AI, the Gemini web interface and API, and Google Assistant. A specific example demonstrated the exfiltration of Google Calendar data, highlighting the severity of the threat to user privacy and data security. The public release of an open-source tool, Anamorpher, to create these malicious images amplifies the risk by lowering the barrier to exploitation. The identified vulnerability, deemed widespread, points to a systemic weakness in current AI security design, requiring mitigations like input dimension restrictions and mandatory user confirmation for sensitive actions, which appear to be absent in the affected platforms.

Key Decisions for Investors

• Investors in Alphabet (GOOGL, GOOG) should closely monitor the company's official response and timeline for patching this vulnerability across its Gemini and Vertex AI product suites, as a slow or inadequate response could damage enterprise-customer trust and hinder AI adoption.
• The strongly negative sentiment (-0.7 for GOOGL) is warranted, and traders should be cautious of potential short-term price volatility driven by negative headlines or evidence of active exploitation of this flaw in the wild.
• This vulnerability highlights a new class of systemic risk for the entire AI sector; therefore, investors should re-evaluate the security posture of other public companies heavily invested in multimodal AI, as they are likely susceptible to similar attacks.
• Consider this a critical test of AI platform maturity; the incident may create a competitive advantage for companies that can demonstrate more robust, secure-by-design architectures against prompt injection attacks.