A county multimodal clerk bot may receive images that hide malicious instructions in embedded text. Which risk should the team detect and mitigate?

Indirect prompt injection is a multimodal responsible-AI risk in which malicious instructions are hidden in content the model consumes as data—here, text embedded inside submitted images—so a clerk bot may follow attacker instructions instead of the developer’s system policy. County teams running multimodal clerk bots must detect and mitigate that risk: treat embedded image text as untrusted, constrain tool actions, and screen for instruction-like payloads in OCR’d or vision-read text. The threat is content-borne indirect instruction hidden inside the image to be obeyed, not a direct request from the user principal, not a jailbreak to bypass safety guardrails, and not a system-prompt disclosure to reveal developer instructions. Direct prompt injection delivered through text embedded inside submitted images mislabels the category: even though the carrier is also image text, direct means the user principal openly issues the instruction, while here embedded text is untrusted data hiding a third-party instruction the bot should not follow, so treating it as direct misses the need to distrust OCR and vision inputs. Jailbreak attempt delivered through text embedded inside submitted images misidentifies the goal: a jailbreak tries to defeat safety guardrails to elicit blocked or disallowed behavior, not to plant a third-party instruction in untrusted image data that redirects the clerk bot’s normal actions, so guardrail testing fixes it rather than distrusting OCR and vision inputs and constraining tool actions. System prompt extraction delivered through text embedded inside submitted images is a confidentiality attack trying to make the bot reveal its developer system instructions, not an attempt to make it obey a hidden instruction in the current submission, so prompt-confidentiality controls fix it rather than injection screening. Exam caveat: indirect injection can succeed even when the user did not type the malicious text; the image is the carrier. Keep it distinct from direct injection (same image-text carrier but labeled as user-issued rather than hidden data), jailbreak attempt (bypassing safety guardrails to get disallowed output), and system prompt extraction (leaking developer instructions)—each needs its own mitigation. Operational check: test the bot with benign images that contain written instructions trying to override policy, verify the system refuses or escalates, monitor OCR/vision extracts for imperative phrases, and keep high-impact clerk actions behind confirmation.