Identify the sound defenses against image-borne prompt injection in a tool-using agent

Image-borne prompt injection happens when an attacker hides instructions inside a picture. The vision model reads that hidden text and might follow it as if it were a real command from the user. The danger gets much worse when the agent can call tools, because a hidden instruction can trigger a real action like sending data. The correct defenses all come from one idea: **anything the model pulls out of an image is untrusted data, not a command**. So you keep extracted image text out of the privileged instruction channel, you run content moderation on the image itself and on the text you extract from it, and you apply least privilege so image-derived content cannot quietly trigger sensitive actions. You also require a human to confirm before the agent does anything high-impact. The two wrong answers both break the trust boundary. Trusting image text more than typed text is backwards — uploaded content is exactly where an attacker hides things. Filtering only the typed prompt to save latency leaves the visual channel, the actual attack path, completely unguarded. The whole point is that no single filter is enough, so you stack data versus instruction separation, visual moderation, and least-privilege tool access.

The correct options share one principle: treat the image as an untrusted input channel. Image-borne injection works because instructions hidden in a picture reach the model through a path that text-only safety filters never inspect. The blast radius grows once the agent can call tools. The four sound defenses map directly to that threat model. The foundation is **treating extracted image text as untrusted data**. That keeps any instruction the model reads out of a picture out of the privileged system channel. It is content to reason about, never a command to obey. Moderating the visual channel and the extracted text closes the gap that a filter on the typed prompt alone leaves open. Least privilege on tools ensures image-derived content cannot trigger sensitive actions unattended, scoping credentials and capabilities tightly. Requiring **confirmation for high-impact actions** puts a human in the loop where an irreversible operation is at stake. The two distractors are textbook trust-boundary inversions. Trusting image text more than typed text assumes uploads are safe, when uploaded content is precisely where injection hides. Filtering only the typed prompt to save latency leaves the visual channel — the actual attack surface — wide open, trading the entire defense for a few milliseconds. The meta-point is defense in depth: none of these layers is sufficient alone. You stack channel separation, visual moderation, and least-privilege tool access so that bypassing one does not hand the attacker the agent.