MIP against Agent: Malicious Image Patches Hijacking Multimodal OS Agents

arXiv 2503.10809 ↗First posted 13 Mar 2025cs.CR cs.LGcited by 12

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Recent advances in operating system (OS) agents have enabled vision-language models (VLMs) to directly control a user's computer. Unlike conventional VLMs that passively output text, OS agents autonomously perform computer-based tasks in response to a single user prompt. OS agents do so by capturing, parsing, and analysing screenshots and executing low-level actions via application programming interfaces (APIs), such as mouse clicks and keyboard inputs. This direct interaction with the OS significantly raises the stakes, as failures or manipulations can have immediate and tangible consequences. In this work, we uncover a novel attack vector against these OS agents: Malicious Image Patches (MIPs), adversarially perturbed screen regions that, when captured by an OS agent, induce it to perform harmful actions by exploiting specific APIs. For instance, a MIP can be embedded in a desktop wallpaper or shared on social media to cause an OS agent to exfiltrate sensitive user data. We show that MIPs generalise across user prompts and screen configurations, and that they can hijack multiple OS agents even during the execution of benign instructions. These findings expose critical security vulnerabilities in OS agents that have to be carefully addressed before their widespread deployment.

Key facts. Cited by 12 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 55 of its 101 references that are in the map. First posted on arXiv 13 Mar 2025.

Builds on

55 of 101 references.

Closest ancestors · 7

Same direction, newest first

Other references · 48

2017Attention Is All You Needcited by 60,361
2023GPT-4 Technical Reportcited by 18,396
2022Training language models to follow instructions with human feedbackcited by 15,971
2024The Llama 3 Herd of Modelscited by 14,715
2014Explaining and Harnessing Adversarial Examplescited by 7,364
2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,585
2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
2013Intriguing properties of neural networkscited by 5,155
2023Grounding DINO: Marrying DINO with Grounded Pre-Training for Open-Set Object Detectioncited by 3,332
2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
2023ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIscited by 1,947
2016Adversarial examples in the physical worldcited by 1,769

36 more

2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
2023Gorilla: Large Language Model Connected with Massive APIscited by 1,332
2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
2024OSWorld: Benchmarking Multimodal Agents for Open-Ended Tasks in Real Computer Environmentscited by 1,195
2019Adversarial Examples Are Not Bugs, They Are Featurescited by 953
2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 546
2023Set-of-Mark Prompting Unleashes Extraordinary Visual Grounding in GPT-4Vcited by 299
2023On Evaluating Adversarial Robustness of Large Vision-Language Modelscited by 284
2018Adversarial Attacks and Defences: A Surveycited by 259
2024Windows Agent Arena: Evaluating Multi-Modal OS Agents at Scalecited by 223
2024APIGen: Automated Pipeline for Generating Verifiable and Diverse Function-Calling Datasetscited by 198
2024OmniParser for Pure Vision Based GUI Agentcited by 198
2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 172
2024UFO: A UI-Focused Agent for Windows OS Interactioncited by 148
2022Towards Adversarial Attack on Vision-Language Pre-training Modelscited by 144
2024Robust CLIP: Unsupervised Adversarial Fine-Tuning of Vision Embeddings for Robust Large Vision-Language Modelscited by 120
2024xLAM: A Family of Large Action Models to Empower AI Agent Systemscited by 111
2023Set-level Guidance Attack: Boosting Adversarial Transferability of Vision-Language Pre-training Modelscited by 108
2021Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attackscited by 101
2023On the Robustness of Large Multimodal Models Against Image Adversarial Attackscited by 92
2020Improving Image Captioning with Better Use of Captionscited by 84
2024Best-of-N Jailbreakingcited by 76
2024ToolGen: Unified Tool Retrieval and Calling via Generationcited by 74
2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 66
2023SA-Attack: Improving Adversarial Transferability of Vision-Language Pre-training Models via Self-Augmentationcited by 39
2024CRAB: Cross-environment Agent Benchmark for Multimodal Language Model Agentscited by 39
2024Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attackscited by 39
2022Calibrated Interpretation: Confidence Estimation in Semantic Parsingcited by 33
2024Failures to Find Transferable Image Jailbreaks Between Vision-Language Modelscited by 30
2024Gradient-based Jailbreak Images for Multimodal Fusion Modelscited by 14
2024Adversarial Attacks to Multi-Modal Modelscited by 12
2025Shh, don't say that! Domain Certification in LLMscited by 7
2024Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approachcited by 6
2023A reading survey on adversarial machine learning: Adversarial attacks and their understandingcited by 1

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 3; 2026: 9.

12 papers.

2025Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agentscited by 71
2025Manipulating Multimodal Agents via Cross-Modal Prompt Injectioncited by 44
2026CaMeLs Can Use Computers Too: System-level Security for Computer Use Agentscited by 17
2026Adversarial Attacks on Multimodal Large Language Models: A Comprehensive Surveycited by 4
2026Preference Redirection via Attention Concentration: An Attack on Computer Use Agentscited by 3
2026Untrusted Content Masking for Web Agents with Security Guaranteescited by 3
2025Cross-Modal Content Optimization for Steering Web Agent Preferencescited by 0
2026Directional Embedding Smoothing for Robust Vision Language Modelscited by 0
2026Securing Computer-Use Agents: A Unified Architecture-Lifecycle Framework for Deployment-Grounded Reliabilitycited by 0
2026MobileWorldSafety: Benchmarking GUI Agent Safety Against Environmental Injection Attacks in Android Appscited by 0
2026AgentHijack: Visual Patch Attacks on Multimodal Computer-Use Agentscited by 0
2026Securing Computer-Use Agents Against Branch Steering Attackscited by 0

Similar, not cited

Close in wording, no citation either way