Shipped: Steganographic Prompt Injection — Agentic AI Provenance Defense

An open-source agentic AI security research proof of concept demonstrating how malicious instructions hidden inside ordinary-looking images can bypass text-based prompt-injection scanners and trigger unauthorized actions in multi-agent workflows.

The research examines three steganographic carriers—least-significant-bit (LSB) encoding, discrete cosine transform (DCT), and image metadata. A seemingly harmless email signature logo conceals instructions that become visible only when a tool decodes the image. The extracted content can then be relayed between agents as trusted information, creating a cross-modal prompt-injection vulnerability.

To address this threat, the project introduces decode-time provenance binding. At the decoding boundary, the MCP enforcement layer assigns HMAC-signed UNTRUSTED labels, maintains dependency and context lineage, and blocks critical tool calls influenced by untrusted content.

Across 24 experimental payloads, the undefended testbed experienced a 100% attack success rate, while conventional content scanning allowed 62.5% of attacks to succeed. The proposed provenance defense blocked all 24 attacks in the controlled evaluation. Additional experiments examine label substitution, multi-agent relaying, legitimate task completion, and runtime overhead.

Built as a reproducible Python and Google Colab experiment, the project explores a zero-trust approach to securing agentic AI systems against concealed instructions and unauthorized tool execution. Results are limited to a controlled research testbed, not a production-validated security solution.