Prompt-injection scanner for AutoGen agents

How multimodal content flows through AutoGen

AutoGen's message format (both the v0.4 AgentChat MultiModalMessage and the legacy ConversableAgent dict-format) supports mixed-content messages: a single message can contain a text block, one or more image URLs or base64 blobs, and file attachments. The group-chat relay broadcasts this message as-is to every registered agent.

The agents that receive it pass the full message structure to their underlying LLM call. A GPT-4o or Claude 3 call that receives an image block runs its vision encoder on that image — the same encoder that indirect-prompt-injection research demonstrates can be tricked by typographic payloads in images that look visually innocuous to humans.

Four entry points introduce multimodal content into an AutoGen conversation:

1. User proxy initial message. When a human or a UserProxyAgent fires the first message with an attached image or file, the payload goes to every group-chat participant in the first round. Scan before initiate_chat().
2. Code-executor output. An ExecutorAgent that runs code producing a PNG, chart, or graph and embeds the output in its reply introduces a code-generated artifact into the conversation. Code execution is a powerful tool-call escalation surface: a crafted payload can survive through the code path unchanged. See the 2026 threat model for the tool-call escalation pattern.
3. Tool call results from external APIs. Agents with function tools that return images (a browser screenshot tool, a search result with embedded images, a chart-rendering API) introduce third-party-sourced bytes into the conversation. Third-party content carries implicit low source trust.
4. File attachments passed to a MultimodalConversableAgent. Documents, PDFs, and audio files passed via the file field trigger AutoGen's built-in file-reading path. The file bytes reach the LLM before any text extraction — if a PDF contains embedded images, those images are part of the LLM call payload.

AutoGen v0.4 — scan placement with the AgentChat API

AutoGen v0.4 restructures around the AssistantAgent / UserProxyAgent model with a cleaner message-processing API. The on_messages method on each agent accepts a list of ChatMessage objects; override it to intercept multimodal content:

from autogen_agentchat.agents import AssistantAgent
from autogen_agentchat.messages import MultiModalMessage
import httpx, base64

class ScannedAssistantAgent(AssistantAgent):
    async def on_messages(self, messages, cancellation_token):
        for msg in messages:
            if isinstance(msg, MultiModalMessage):
                for item in msg.content:
                    if hasattr(item, "data"):  # Image content block
                        score = await glyphward_scan(item.data, "image")
                        if score > 70:
                            raise ValueError(
                                f"Multimodal PI blocked (score {score}) — "
                                f"message from {msg.source} quarantined."
                            )
        return await super().on_messages(messages, cancellation_token)

async def glyphward_scan(b64_data: str, modality: str) -> int:
    async with httpx.AsyncClient() as client:
        resp = await client.post(
            "https://api.glyphward.com/v1/scan",
            json={"data": b64_data, "modality": modality, "source_trust": "low"},
            headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
            timeout=5,
        )
        return resp.json()["score"]

Apply ScannedAssistantAgent as the base for every agent in the group chat. The scan runs asynchronously per-agent per-message, in parallel with other pre-processing — marginal latency over a standard round-trip is typically under 200 ms per image block.

Legacy ConversableAgent — override receive()

For AutoGen v0.2 / v0.3 (the ConversableAgent pattern), the intercept point is the receive() method, which is called each time an agent gets a message before its generate_reply() runs:

class ScannedConversableAgent(ConversableAgent):
    def receive(self, message, sender, request_reply=None, silent=False):
        # message is a dict; content may be a list with image_url entries
        if isinstance(message.get("content"), list):
            for part in message["content"]:
                if part.get("type") == "image_url":
                    url_or_b64 = part["image_url"].get("url", "")
                    if url_or_b64.startswith("data:image"):
                        b64 = url_or_b64.split(",", 1)[1]
                        score = glyphward_scan_sync(b64, "image")
                        if score > 70:
                            raise Exception(f"PI blocked (score {score})")
        super().receive(message, sender, request_reply, silent)

The same pattern applies to any framework that uses the OpenAI message format with image_url content blocks — the scan placement is identical, only the hook method name changes.

Threat model: why agentic escalation is worse than single-LLM PI

In a single-agent setup, a successful prompt injection causes one model to misbehave once. In an AutoGen group chat, a successful injection causes every downstream agent to operate under the attacker's instruction for the rest of the conversation. A researcher agent that produces a maliciously crafted chart passes that chart to a writer agent, a QA agent, and an executor agent — all of whom see the embedded instruction in their context. The executor agent in particular may have code-execution, file-write, or API-call privileges, turning an image PI into arbitrary code execution.

This is the agentic escalation pattern documented in MITRE ATLAS T0051 (LLM Prompt Injection) and in the OWASP LLM01:2025 multimodal sub-category. The blast radius in a group-chat architecture is larger than in a direct-chat architecture by the number of agents in the group minus one.

How Glyphward fits

Glyphward's /v1/scan accepts image bytes (base64 PNG / JPEG / WebP) or audio bytes (WAV / MP3 / OGG), returns a 0–100 risk score, the flagged bounding region or time window, and per-signal confidences. The async Python client fits naturally into AutoGen v0.4's async agent architecture. The sync client works in legacy receive() overrides.

Existing text-side guardrails — Lakera Guard, Azure Prompt Shields, LLM Guard — remain on the text and function_call message paths. Glyphward closes the image_url, file, and audio paths those guards cannot reach. See pricing comparison for the full cost-per-scan analysis across providers.

Get early access

Related questions

Further reading

• The multimodal prompt-injection threat model for AI product teams (2026) — full threat model including the agentic escalation pattern.
• Prompt-injection scanner for CrewAI agents — the crew-based multi-agent sibling; same threat, different hooks.
• Prompt-injection scanner for LangChain agents — the LangChain agent framework placement.
• MITRE ATLAS multimodal prompt injection — red-team vocabulary for scoping multi-agent security reviews.
• OWASP LLM01:2025 multimodal — compliance framing for agentic-pipeline AppSec reviews.
• FigStep detection — the image-PI attack class AutoGen's group-chat relay propagates.
• Multimodal LLM security API — the category-level overview.