Seeing Is Not Screening: Multimodal Hidden Instruction Attacks on Agent Skill Scanners

A preprint posted to arXiv on 16 June 2026 describes a new attack that hides malicious instructions inside images to evade security scanners built for large language model agents [1][2]. The work identifies a blind spot in current defenses and proposes a countermeasure called ExecScan [2]. The paper, titled “Seeing Is Not Screening,” argues that agent skills — modular capabilities added to LLM-based systems — have become a significant attack surface [2]. Large language models are machine learning models trained on vast amounts of text for tasks such as language generation [10]. As these systems are extended with third-party skills, researchers have begun scrutinizing how those skills are vetted [2]. The authors conducted an empirical study of existing skill scanners and concluded that defenses rely overwhelmingly on textual descriptions, manifests, and source code to flag malicious behavior [2]. “This creates a practical blind spot: harmful operational instructions hidden in images may bypass scanning while still being recoverable by multimodal agents during deployment,” the paper states [2]. To demonstrate the risk, the researchers developed SkillCamo, a document-mediated multimodal instruction attack. SkillCamo embeds malicious payloads inside images that are bundled with a skill and rewrites the accompanying documentation so that the images appear to be part of a normal workflow [2]. The attack does not depend on the image alone; it exploits the joint interpretation of textual guidance and visual content at execution time [2]. Because current scanners do not jointly analyze text and imagery, the hidden instructions can slip through [2]. The proposed defense, ExecScan, takes an execution-grounded approach. It performs intent extraction, behavior reconstruction, abuse assessment, and deliberative execution simulation across all skill artifacts [2]. By jointly analyzing documentation, code, referenced resources, and visual content, ExecScan reconstructs executable behavior chains and flags downstream risks including exfiltration, destruction, persistence, deception, and privilege escalation [2]. The paper reports that image-hidden malicious instructions consistently challenged existing scanners, while ExecScan improved scanning performance [2]. The research appears on arXiv, an open-access repository of electronic preprints that is moderated but not peer-reviewed [8]. As of November 2024, the repository was receiving about 24,000 new articles per month [8]. The paper was submitted under the Cryptography and Security category and is available in both PDF and experimental HTML formats [1].