The malicious instruction appeared only after a tool decoded the attachment

Prompt injection need not arrive as an obvious instruction pasted into a chat. It may start as pixels, faint document text, or a detail removed from a context summary. The dangerous transition is when a later step makes that lower-trust material look like a current instruction, or loses an earlier rule that should constrain it.

In a controlled email-signature experiment, Eric Yocam and collaborators embedded commands through image data and metadata formats. Decoding tools exposed content that a downstream agent could treat as instructions. All 24 adaptive payloads succeeded against the undefended mediated setup, while a keyword defense allowed 62.5 percent. A tested provenance ledger that bound tool output to permitted sinks reduced success to zero in that specific mediated testbed. It does not cover unmediated subprocess execution or guarantee security in every deployment.

The Brazilian STJ petition incident shows a different entry point: near-invisible text in a document submitted for review. The court reported detecting an attempted instruction injection and sanctioning counsel. The record does not show the court's decision was changed. Its significance is that visually inconspicuous text can still reach document extraction and AI-assisted analysis.

Jeanne Salle and coauthors studied the complementary loss of rules in agent context compaction. Their benchmarks found an initial summary omitted roughly one third of anti-cheating instructions, and process constraints were lost much more often than the requested task specification in selected coding settings. The omissions are observations about text preservation; they are not proof that each missing rule was violated.

A tool might correctly decode an image or OCR a document and still return attacker-authored instructions. Fidelity to the file does not confer authority. Similarly, a compacted transcript may faithfully summarize the main task while losing a prohibition that remains binding. Both failures are avoided only when the application maintains the original authority boundary independently of conversational prose.

The test is operational: after conversion, can the system still answer who supplied this text, which instructions are mandatory, and which tool effects are permitted? The steganographic study and compaction measurements establish narrow laboratory observations. The court report establishes an attempted injection and a sanction. None of those evidentiary categories should be silently promoted into a measured production compromise rate.

A machine-readable message is not an authorized command merely because a machine managed to read it.