Research demo
Image to prompt injection with Google Bard
AIR-2023-0016 AIR record · 2023-07-google-bard-image-to-prompt-injection
From the supporting source
Recently, Google added the ability to uploading and analyze images with Bard.embracethered.com
The record
Disclosed
2023-07-14
Vendor
Google
Product
Google Bard
Risk domain
Agent behaviour › Unsafe actuation
Also touches
Sensitive data exposure, Confused deputy
System type
Generative model
Who acted
Agent acted (contested) — the image OCR injection drove unauthorized actions
Attack surface
Consumer assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection image
Impact type
Unauthorized action, Information disclosure
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI01 – Agent Goal Hijack
- MITRE ATLAS
- AML.T0048 – External Harms
- NIST AI RMF
- MEASURE 2.6; MANAGE 1.3
- EU AI Act
- Annex III §1(c)
- ISO/IEC
- TR 24028; 24029-1; 23894
- AIUC-1
- C. Safety
- Scope
- agent misuse
- Mitigation
- Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Bard users uploading untrusted images
Capability abused
Defense & remediation
Recorded defense
none
Guardrail kinds
None
Guardrail outcome
Not applicable
Taxonomy & references
Curator notes
Johann Rehberger. Early demonstration that image OCR is an injection channel; no vendor response documented. Quote is thin - the post is a short technique note rather than a disclosure.
Cite as
Enkrypt AI. "Image to prompt injection with Google Bard". AIR, AIR-2023-0016. https://agentincident.vercel.app/i/AIR-2023-0016/ (accessed 2026-10-19).