The Question
Your AI security controls — prompt guardrails, input filters, content classifiers — were almost certainly designed with text in mind. A user types something. The system inspects it. A decision is made.
Multimodal AI systems do not work that way. They process images, audio, PDFs, video frames, and documents alongside text. Each modality is a potential injection vector. Most guardrail products inspect text. Most enterprise security teams have not asked what happens when the attack arrives as an image.
This is an extension of OWASP LLM01: Prompt Injection — the same attack class, delivered through non-text inputs that most defenses do not inspect. As enterprises deploy multimodal AI, the injection surface expands to every modality the model can read.
Why This Matters Now
In 2023, researchers demonstrated that GPT-4V — OpenAI's multimodal model capable of processing images alongside text — could be manipulated through what they called "visual prompt injection." The technique was straightforward: hide instructions inside an image in a way that the human viewing the image cannot see, but the AI model will read and process.
One implementation used white text on a white background — invisible to a human looking at the image, but fully parsed by the model's vision system. Another used text rendered at a size too small for comfortable human reading but well within the model's processing capability. In both cases, a user could share what appeared to be an ordinary image — a product photo, a screenshot, a document scan — that contained hidden instructions the AI would execute.
The practical implication: any enterprise AI system that processes user-submitted images as part of a workflow has a prompt injection surface that its text-based guardrails will not see.
This is not a hypothetical future problem. Voice assistants have been demonstrated vulnerable to ultrasonic commands — audio instructions pitched above the range of human hearing but within the processing range of microphone-equipped devices. Autonomous vehicle research has documented adversarial stickers placed on stop signs that caused AI vision systems to misclassify them. The attack pattern — hiding instructions in a modality that humans process differently than machines — is consistent across every modality AI systems can read.
What the CURVE™ Data Shows
Multimodal attack coverage is the most significant capability gap in the 2026 AI security vendor landscape. The majority of the guardrail, prompt injection defense, and AI firewall products Stackcurve evaluated were built primarily or exclusively for text-based LLM inputs. Coverage of image-based injection, audio-based attacks, and document-embedded instructions varied from limited to nonexistent.
This is partly a maturity issue — multimodal AI deployment at enterprise scale is newer than text-only LLM deployment, and the vendor market has not fully caught up. It is also partly a detection difficulty issue: inspecting an image for hidden instructions requires different infrastructure than inspecting text, and the detection methods are less mature.
The full vendor rankings are in the 2026 AI Security CURVE™ Report — free to download.
The vendors closest to addressing multimodal threats are those with computer vision and document security heritage extending into AI security — and the pure-play agentic security vendors building modality-agnostic behavioral detection rather than input-specific filtering. Neither group has fully solved the problem.
The Gap Most Buyers Miss
The multimodal attack surface is wider than most security teams appreciate, because it is not limited to image files. Consider what a modern enterprise multimodal AI system might process:
Document PDFs — a submitted PDF can contain text, images, and metadata. Instructions can be embedded in any layer. A contract review AI that processes PDFs from external parties is reading adversarially controllable content on every submission.
Screenshots and screen captures — enterprise AI tools that analyze screenshots for workflow automation, support ticket processing, or document extraction process visual content that any sender can control. The content of a screenshot is entirely at the sender's discretion.
Audio transcripts and voice interfaces — voice-enabled AI assistants process audio that can contain ultrasonic commands inaudible to nearby humans, or audio that has been crafted to trigger specific model behaviors through adversarial perturbation.
Embedded images in documents and emails — a Word document or email with an embedded image is a document that contains a potential injection vector. Enterprise AI tools that process email attachments or document libraries for summarization, extraction, or routing are processing those embedded images.
QR codes and barcodes — multimodal AI systems that can read QR codes will process the URL or text encoded in them. A QR code that encodes a prompt injection payload is visually indistinguishable from a legitimate QR code.
The common thread: any content type that a human views as data but a multimodal AI system processes as potential instructions is an injection vector.
Questions Your Buying Team Should Be Asking
1. Which input modalities does your AI security tooling inspect? Ask your guardrail and AI firewall vendors explicitly. If their answer is limited to text inputs, ask whether they have a roadmap for image, audio, and document coverage — and what the timeline is.
2. What content types does your multimodal AI deployment accept from external sources? Map every point where untrusted content enters your AI system — uploaded images, submitted documents, processed emails, scraped web content — and evaluate the guardrail coverage for each modality separately.
3. Have you red-teamed your multimodal AI systems specifically for visual injection? Standard LLM red teaming focuses on text inputs. Ask your red team provider whether they test for visual prompt injection, document-embedded instructions, and audio attack vectors. If they do not, your red team scope has a gap.
4. How does your AI system handle content from external parties? Any AI workflow that processes content submitted by untrusted external parties — customer-submitted documents, vendor invoices, support attachments — is processing adversarially controllable input. The guardrail posture for these workflows should be higher than for internal-only content.
5. Does your AI security monitoring log non-text inputs? If your monitoring pipeline captures text prompts but not the images, documents, or audio your AI system processes, you have a blind spot in your audit trail. A multimodal injection attack that occurs through an image will leave no trace in a text-only log.
The Stackcurve Take
The history of security vulnerabilities follows a consistent pattern: attackers find the input channel that defenses are not watching. SQL injection exploited the database query channel. XSS exploited the HTML rendering channel. Multimodal prompt injection exploits the visual, audio, and document channels that AI security controls were not built to inspect.
The defense principle is the same one that resolved those earlier classes: treat every input channel as untrusted, and inspect it as close to the model as possible. For multimodal AI, that means extending your guardrail architecture to cover the modalities your AI system actually processes — not just the text interface.
The practical first step for most enterprises is an audit: identify every multimodal AI deployment and every content type it accepts, then assess which of those content channels have guardrail coverage and which do not. The gaps that audit surfaces are your priority list.
The vendor market for multimodal security controls is early. Behavioral monitoring — detecting anomalous model behavior regardless of input modality — is the most robust control currently available, because it catches the effect of an injection rather than trying to detect the injection itself in every possible visual or audio form. For enterprises with significant multimodal exposure, behavioral monitoring is the priority investment while modality-specific detection matures.
The 2026 Stackcurve AI Security CURVE™ Report covers the AI Firewall & Gateway and Agentic AI Security categories most relevant to multimodal defense. Download it free →
Stackcurve Advisory Briefs are independent research. No vendor pays for placement, tier assignment, or editorial influence. The CURVE™ methodology is disclosed in full at stackcurve.net/research/methodology.