Agentic AI frameworks enable large language models to plan, retain memory, and invoke tools that access real files, emails, and services. Most agents also process images, giving attackers a way to inject text into the agent's context without passing through the user. We introduce MMPIBench, a reproducible benchmark that measures how injected instructions propagate inside an agent. The benchmark delivers a fixed set of attacks via six visual carriers (OCR text, overlays, EXIF metadata, QR codes, fake interfaces, and hybrids) and records the instruction's journey from perception through planning to tool invocation.
Across 720 runs covering six frameworks, five foundation models, six carriers, and four attacker objectives, attacks succeed in roughly 1% of runs but are attempted in 12.8%. The gap closes almost entirely at the planning step, where the model reads the injected instruction and declines to act on it. The choice of model matters far more than the framework: one model never attempts an attack and recognizes the injection in 59.7% of runs, while two others attempt in 23.6%.
We then extend the benchmark to audio, the only other raw perceptual channel accepted by current frontier models. Only two of the five models ingest audio and only three of the six frameworks deliver it, but where the signal arrives the attack completes in 49% of cells, and up to 75% for a single model. Reporting completion alone therefore understates exposure; perceptual channels beyond vision are narrower but far less defended.
Review