Decoded image payloads become agent instructions after an email tool step

An attacker cannot directly edit a system instruction, but can place encoded content in material the agent is legitimately asked to inspect. When a decoder returns hidden text, a planner may treat the recovered string as task guidance rather than data from an untrusted email signature. The unsafe step is promotion across modality and authority boundaries.

The authors report image LSB, DCT and metadata instruction encodings decoded through agent tools, with 24 controlled attack payloads. Their mediated enforcement prototype blocked tested malicious sink actions, unlike text keyword filtering. The reported success figures are specific to a mediated testbed, with 100 percent attack success without defense, 62.5 percent under one keyword approach, and zero successes in the tested HMAC provenance-ledger condition. These are not general effectiveness rates across unmediated subprocesses.

Attach origin and authorization metadata to tool results after transformation, and refuse outbound or file sinks when the triggering instructions originated in low-trust email content. Encoding does not confer authority. The important invariant is whether provenance survives OCR, image decoding and later text transformations. Primary evidence.

Additional evidence and trust boundary

An email signature that looks innocuous to a text scanner can yield executable instructions after an image decoder expands it. The trust boundary must travel with the decoded bytes: HMAC-authenticated labels and lineage prevent a compromised agent from laundering lower-trust content into trusted tool parameters in the mediated setup. These zero-success results do not apply automatically when a subprocess or browser action bypasses the policy broker. Supporting record.