MMPIBench: agents attempt multimodal injections ten times more than they finish

What is this?

On September 8, 2026, Viet K. Nguyen and Mohammad I. Husain of California State Polytechnic University, Pomona posted An Experimental Evaluation of Multimodal Prompt Injection Attacks on Agentic AI Frameworks to arXiv (2609.09404, cs.CR/cs.AI). It introduces MMPIBench, a harness that runs one fixed attack set — identical payloads, identical mock tools, identical system prompt — across six agent frameworks and five foundation models, then records how far each injected instruction travels rather than only whether it won.

The headline number is the gap. Across 720 runs, attacks completed in about 1% of runs but were attempted in 12.8% — roughly ten attempts for every completion. The authors are explicit that this is a measurement study: “We do not propose a defense; MMPIBench is a measurement tool.”

How it works

The benchmark crosses four dimensions: six frameworks (LangGraph, CrewAI, AutoGen, OpenAI Agents SDK, Semantic Kernel, LlamaIndex Workflows), five models (Claude Opus 4.8, GPT-5.4, Gemini 3.1 Pro, Grok 4.3, Llama 4 Maverick), six visual carriers, and four attacker objectives — tool misuse, data exfiltration, memory poisoning, and inter-agent propagation. Tools are mocked, so a “completion” means the agent issued the harmful call, not that a real system was damaged.

The instrumentation is the contribution. Each run is labelled by the furthest stage it reached:

Stage             Meaning                                        Share of 720 runs
----------------  ---------------------------------------------  -----------------
None              Payload never perceived                        32.9%
Perception        Payload read, flagged suspicious, agent stopped 23.6%
Planning          Payload read and reasoned about, not acted on   42.1%
Tool invocation   Malicious tool actually called                   0.3%
Execution         Deterministic judge confirms objective met       1.11%

Three findings fall out of that table.

The model dominates the framework. Per-model attempt rates run from 0.0% (Claude Opus 4.8, which also refused in 59.7% of its 144 runs) to 23.6% (Grok 4.3 and Llama 4 Maverick each). Per-framework attempt rates cluster much more tightly, 10.0% to 21.7% — and the paper flags two confounds in that comparison it cannot separate.

Carriers are wildly uneven. Rendered OCR text was attempted in 27.5% of its runs and accounts for 7 of the 8 total completions. EXIF metadata and QR codes were attempted in 0.0% — in roughly 88% of those runs the payload never reached perception at all, because the models simply do not read EXIF fields or decode QR codes from pixels without an explicit decoding tool.

The stop happens at planning, not at a barrier. Most runs die in the 42.1% planning band, where the model read the instruction and declined to carry it forward. Only 170 of the 217 refusals were caught at perception; the rest carried refusal language but still reached planning.

Why it matters

The ~1% completion rate is the least interesting number in the paper, and the authors say so. Nothing architectural stopped the other 11.8% — the model did. As §VIII-A puts it: “a behavioral guardrail holds only as long as the model keeps making that judgment.”

The audio extension makes the point concrete. Only two of the models natively tokenize audio, and only three of six frameworks actually deliver it — CrewAI accepted audio but never attached it, AutoGen has no audio message type at all. But where the signal arrives, the attack completes in 49% of cells (35 of 72), and in 75% for gpt-audio. A framework that drops a modality is not defending you; it is failing to pass it along, and that gap closes the moment the feature ships.

Compare with VPI-Bench (NUS, June 2025), which reported deception rates up to 51% for computer-use agents and 100% for browser-use agents on live platforms. The two numbers are not in conflict — they measure different threat models, task framings, and whether the user prompt invites tool use. That spread is exactly why a single “success rate” travels badly between papers.

Defenses

The paper evaluates no mitigations. The items below separate what it recommends from ordinary practice.

From the paper:

1. Report attempted and recognized rates, not completion alone. Completion “measures only how often the current generation of models happened to decline.”
2. Distinguish refusal from oversight. “Only recognition is a guardrail. A model that overlooks a payload offers no assurance that it will keep overlooking it as carriers improve.”
3. Watch the planning band. Runs that read a payload and silently ignored it are “a weaker guarantee than a refusal.”
4. Treat a missing modality as an accident. The three-gate model — the model must tokenize the channel, the framework must deliver it, and the model must then refuse — means an attack needs all three gates open. Two of them are shipping decisions, not controls.
5. Extend safety training and evaluation to perceptual channels. Audio is narrower than vision today and much less defended.

Standard practice, not from this paper:

6. Gate the action surface, not the input. No filter caught anything here. Every completion was tool misuse; require confirmation for destructive and outbound calls regardless of how the instruction arrived.
7. Log the artefact with the action. Retain the image or audio alongside any sensitive call so post-hoc review can find the carrier.
8. Re-test on version bumps. The authors call their results “a snapshot of specific versions rather than a durable property of the systems.”

Status

Item	Reference	Date	Notes
Paper	arXiv:2609.09404 v1	2026-09-08	cs.CR / cs.AI, CC BY-NC-ND 4.0
Authors	Nguyen & Husain	—	California State Polytechnic University, Pomona
Scale	720 image runs + 72 audio cells	—	6 frameworks × 5 models × 6 carriers × 4 objectives
Attempted / completed	12.8% / ~1.11%	—	95% Wilson intervals 10.5–15.4% and 0.6–2.2%
Audio completion	49% of cells; 75% for gpt-audio	—	2 models ingest audio, 3 of 6 frameworks deliver it
Benchmark release	Promised on publication	—	No repository URL in the preprint
Real-world exploitation	Not reported	—	Mock tools, controlled research setting

The uncomfortable part is not that one in a hundred attacks worked. It is that the other eleven got far enough for the model’s judgment to be the only thing standing between a rendered instruction and a tool call — and that on the one channel where fewer models are trained to exercise that judgment, half the attacks finished.