When an uploaded image controls your legal AI output

The most troubling legal-tech fact in this risk category is not that a model can be tricked by words. Lawyers already know that adversarial text is a problem. The sharper point is that, in January 2026, a reported vulnerability in vLex Vincent involved hidden text inside legal documents causing a legal AI tool to output malicious HTML that attempted credential capture.[1] The report came through Paubox, citing Cybernews, and vLex’s described remediation has not been independently confirmed in the materials available here. That caveat matters. It does not make the incident disappear.

For a litigation team, the uncomfortable lesson is practical: the input did not have to arrive as an obvious prompt. It could arrive as legal material. It could be part of an exhibit set, a scan, a PDF, or a screenshot routed into a tool because someone on the matter team wanted a faster summary. Once a multimodal system accepts images, the old comfort of “we sanitize the text prompt” no longer covers the whole path.

The Vulnerability Enters Before the Text Filter

Image prompt injection exploits a handoff that many legal AI policies still describe too casually. A user uploads a file. The system’s vision layer interprets pixels. Only after that does the resulting instruction-like content become part of what the model reasons over. A text-only filter may never see the malicious instruction in its original form because the instruction was not submitted as typed text. It was embedded in visual input.

OWASP’s LLM01:2025 now treats prompt injection as extending to multimodal vectors, not merely chat-box manipulation.[2] The Cloud Security Alliance’s March 2026 research note is more specific: it describes typographic visible text, steganographic encoding, adversarial perturbations, and physical-world signage as image-based embedding techniques, and states that no defense fully neutralizes all variants.[3]

That is the image-prompt-injection risk in its least dramatic form. The uploaded image is not just evidence. It is also a possible instruction carrier. If the model is allowed to summarize, browse, draft, classify, call tools, render HTML, or handle credential-adjacent workflows, the consequences move from bad output to security exposure.

Why “A Human Looked at It” Is Not Enough

The Trail of Bits image-scaling work is the finding that should make document-review teams slow down. In August 2025, Trail of Bits showed that an image can look harmless at full resolution but reveal injected instructions after the preprocessing step downsizes it for an AI system. The firm demonstrated the technique against Gemini CLI, Vertex AI, Google Assistant, and Genspark, and released an open-source tool called Anamorpher.[4]

The legal workflow failure is easy to picture. An associate opens the image and sees nothing suspicious. A vendor says the file was available for human review. The matter team later asks why the AI followed an instruction nobody saw. In that scenario, the problem is not inattentiveness. The dangerous content may be produced by the preprocessing pipeline, not by the image state the reviewer actually inspected.

This is also where vendor diligence has to become more concrete. A legal AI provider that says it supports PDFs, screenshots, and images has not answered the security question. The relevant questions are narrower: What image transformations occur before inference? Are uploads resized, cropped, compressed, OCR’d, tiled, or converted? Are the original image, OCR text, vision-derived text, and model input logged separately? Can the customer test adversarial exhibits against the same preprocessing path used in production?

The Known Variants Are Broader Than One Legal Incident

The vLex report matters because it places the vector inside a legal AI setting. The broader literature matters because it shows that the vector is not limited to one product, one prompt style, or one careless implementation.

CSA reported production attack success rates up to 64% for typographic visible-text methods and 31.8% for neural steganographic methods.[3] Those figures should not be read as a prediction that a particular law firm has a 64% breach probability. They are controlled-study results, dependent on model versions, test conditions, preprocessing, and defenses. Used correctly, they still say something important: the class is capable of meaningful success, including through methods that are not merely “write the instruction in big letters on the image.”

CrossMPI pushes the point further. As reported in May 2026, the attack achieved a 66.36% average success rate using imperceptible pixel perturbations, with strong black-box transferability across model architectures.[5] Again, that number belongs to the reported experimental setting. It is not a law-firm incident rate. But it undermines a familiar reassurance: that the risk can be managed simply by telling reviewers to watch for visible prompt text.

The Invisible Injections paper, published on arXiv in July 2025, reported 24.3% overall success and 31.8% neural steganographic success rates.[6] The useful legal takeaway is not the elegance of the steganography. It is that the instruction channel can be visually non-obvious while remaining machine-readable enough to affect model behavior.

What Defenses Actually Buy

The right posture is neither panic nor blind deployment. Some mitigations are concrete enough to use now. Schneider’s March 2026 multimodal injection survey corroborates that JPEG recompression and Gaussian filtering can degrade steganographic payloads while preserving legitimate visual content.[7] For a firm processing untrusted productions, those are attractive controls because they are low-effort, automatable, and do not require waiting for a vendor’s next model release.

They are not a cure. Recompression may help against one class of hidden payloads while doing less against visible typographic attacks. Filtering may degrade useful image quality in a matter where fine visual detail matters. A scaling defense may fail if the pipeline later performs a different transformation. A policy that strips active HTML from model output may reduce credential-capture risk without preventing a poisoned summary. Controls have to be mapped to the attack path they interrupt.

Isolation is the more serious architectural answer. A multimodal model that reads untrusted exhibits should not have the same privileges as a system that can send email, access matter files, call external tools, render active content, or request credentials. CaMeL-style dual-LLM designs are important here because they separate control decisions from untrusted content interpretation. But the caveat is immediate: that direction remains a research prototype rather than a commercially available control a law firm can simply turn on across its document-review stack.

The most defensible near-term approach is layered and unglamorous: normalize images before inference, keep untrusted visual content away from privileged tools, block active output formats where possible, compare model summaries against source documents, and require vendors to disclose the preprocessing pipeline. The associate who uploaded the exhibit should not be the only control point.

Professional Responsibility Is Already in the Room

As of July 2026, the materials here do not identify a documented U.S. judicial sanction specifically for image-based prompt injection. That boundary should be kept clear. The closest comparator is the Brazil prompt-injection sanction case, involving a court AI system, a $16,500 fine, and a bar referral in May 2026. It is not an image-specific U.S. precedent. It does show that courts can understand prompt injection as professional-conduct territory rather than as an abstract computer-science issue.

For law firms, the malpractice surface appears at the handoff points. A knowledge-management lawyer approves a tool after reviewing marketing materials but not the image pipeline. A litigation team routes adversarial exhibits into a summarizer connected to broader matter context. An in-house lawyer receives an AI-generated digest and assumes the system followed the user’s instruction rather than an instruction hidden in the source material. Each person can truthfully say they reviewed their part. The system still fails between them.

This is why a verification workflow for auditing multimodal legal AI tools should test the actual upload formats a matter team uses: scanned PDFs, screenshots, photographs, and image-heavy productions. It should also test the output modes the tool permits. A model that only returns plain-text summaries presents a different risk than one that can generate HTML, trigger plugins, retrieve documents, or draft communications from the same untrusted input.

The July 2026 Operating Assumption

The safe assumption for this quarter is that untrusted image input is active content. It may not execute code in the traditional sense, but it can alter the behavior of the system asked to interpret it. That is enough to matter in legal work, where a poisoned summary, a credential prompt, or a disclosure of privileged context can create consequences long after the upload looked routine.

Law firms can reduce risk through preprocessing, isolation, vendor due diligence, and human verification. The evidence does not support treating any single defense as complete. As of July 2026, image prompt injection remains an active vulnerability class for multimodal legal AI, and untrusted exhibits, scans, PDFs, screenshots, and photographs should be handled as a security and malpractice surface before they are handed to a model.

References

1. Hidden prompt attack in legal AI tool exposes risk to law firms, Paubox, Jan 2026.
2. LLM01:2025 Prompt Injection, OWASP.
3. CSA Research Note: Image Prompt Injection in Multimodal LLMs 2026, Cloud Security Alliance, Mar 2026.
4. Weaponizing image scaling against production AI systems, Trail of Bits, Aug 2025.
5. New image-based prompt injection attack targets multimodal AI models, CSO Online, May 2026.
6. Invisible Injections, arXiv, Jul 2025.
7. Multimodal Prompt Injection, Christian Schneider, Mar 2026.