Prompt injection in retail pharmacy and drug dispensing AI

Four adversarial injection surfaces in retail pharmacy and drug dispensing AI

1. Prescription label scan AI injection (McKesson, Omnicell EnlivenHealth AI, ScriptPro AI, ARxIUM)

Pharmacy dispensing AI processes photographs of prescription labels, drug package barcodes, and pill bottles submitted through automated dispensing verification workflows to confirm that the dispensed drug matches the prescription order before dispensing to the patient. McKesson’s pharmacy AI platform — integrated with its CoverMyMeds electronic prior authorisation and medication adherence programmes — processes prescription label verification images across the McKesson drug distribution network supplying approximately 50% of US hospital and retail pharmacies. Omnicell’s EnlivenHealth AI and Omnicell XR2 automated dispensing cabinet AI process drug package label scans to verify that the correct medication has been loaded into the automated dispensing cabinet at hospital and retail pharmacy locations, with Omnicell serving 6,200+ pharmacy sites including retail, hospital, and long-term care settings. ScriptPro’s SP robotic dispensing systems use AI-assisted barcode and label scanning to verify dispensed units at retail pharmacy chains including Walgreens, Rite Aid, and independent retail pharmacies. ARxIUM’s pharmacy automation systems, including the RIVA compounding robot and the NEXUS IV workflow management platform, use AI image verification for intravenous (IV) preparation compounding in hospital pharmacy clean rooms.

The adversarial injection surface is the prescription label photograph submission pathway: images captured by the pharmacy robot’s built-in camera system, images scanned through the pharmacist’s verification workstation barcode reader integrated with the dispensing management system, or images submitted through API integrations with pharmacy benefit managers (PBMs) and e-prescribing platforms. An adversarially crafted prescription label photograph — in which pixel perturbations applied to the drug name characters, strength denomination text, or NDC barcode cause McKesson AI or Omnicell AI to read the label as a different drug name, a different strength, or a different NDC than the actual printed label — can produce a dispensing verification pass on the incorrect drug or strength without triggering a pharmacist alert. Look-alike/sound-alike (LASA) drug pairs represent the highest-consequence adversarial misread targets: methotrexate vs methocarbamol (oncology vs muscle relaxant), hydroxyzine vs hydralazine (antihistamine vs antihypertensive), losartan vs lovastatin (ARB vs statin), and insulin products with similar packaging and names (Humalog vs Humulin, NovoLog vs Novolin) are among the ISMP high-alert medication pairs where an adversarially induced one-character misread produces a therapeutically unrelated drug at the wrong dose.

The regulatory consequence is direct under FDA 21 CFR Part 211.68 (Automatic, mechanical, and electronic equipment) and 21 CFR Part 211.100 (Written procedures; deviations), which require that automated pharmacy equipment perform correctly and that deviations be documented and investigated. A dispensing verification AI that has been compromised by adversarial label photograph manipulation constitutes a validated equipment performance failure under 21 CFR Part 211 — one that is not detected by routine equipment performance monitoring because the AI produces a verification pass rather than a failure flag. The Institute for Safe Medication Practices (ISMP) MedWatch reporting system and the FDA MedWatch reporting system receive reports of dispensing errors in the LASA drug class annually; adverse drug event (ADE) data from AHRQ’s National Inpatient Sample suggests approximately 700,000 emergency department visits and 120,000 hospitalisations annually in the US attributable to adverse drug events including dispensing errors. Adversarial injection that systematically exploits AI prescription label verification for LASA drug errors adds a new threat vector to dispensing error reporting that existing ISMP and FDA MedWatch tracking systems are not calibrated to identify. Threshold: 50 for prescription label verification AI (patient safety, ISMP high-alert medications, 21 CFR Part 211).

2. Compounding pharmacy batch record AI injection (CAPS AI, CivicaRx AI, Baxter IntelliFill AI)

Compounding pharmacy AI processes batch record documentation photographs — images of weighed ingredients, compounding worksheets, and finished preparation documentation — through AI verification workflows that confirm ingredient identity and quantity before compounding batches are released for patient use. The 503B outsourcing facility industry — created by the Drug Quality and Security Act (DQSA) of 2013 following the 2012 New England Compounding Center (NECC) fungal meningitis outbreak that killed 64 patients — supplies compounded sterile preparations (CSPs) to hospital pharmacies and surgery centres at scale, with major 503B facilities including Baxter’s IntelliFill compounding operations, CAPS (Compounding Aseptic Processing) at 28 US locations, and CivicaRx supply stabilisation facilities processing thousands of compounded sterile preparation batches weekly. These facilities use AI-assisted batch record verification to confirm that compounding worksheets show the correct ingredients at the correct quantities before batch release — a critical control at the 503B level, where a single batch release error can affect hundreds of patient doses simultaneously.

The adversarial injection surface is the batch record document photograph submission pathway: images of compounding worksheets, ingredient weighing photographs, and finished preparation documentation captured by the pharmacy technician’s workstation camera or tablet app and submitted to the batch record management system for AI verification. An adversarially crafted compounding batch record photograph — in which pixel perturbations applied to the ingredient name characters, quantity values, or weighing balance display digits cause the AI to verify an incorrect ingredient or incorrect quantity as conforming to the batch record specification — can enable a compounding batch with an ingredient error to pass AI batch release verification without triggering a pharmacist quality review. The compounding ingredient error categories most consequentially affected by adversarial AI batch record manipulation are those with a narrow therapeutic index: potassium chloride (KCl) concentration errors at IV admixture concentrations produce cardiac arrest; methotrexate concentration errors in intrathecal preparations produce neurotoxicity and death; morphine sulfate concentration errors in patient-controlled analgesia (PCA) pump fills produce respiratory depression; magnesium sulfate concentration errors in obstetric eclampsia management produce cardiac arrest.

USP General Chapter <797> (Pharmaceutical Compounding — Sterile Preparations) and USP General Chapter <795> (Pharmaceutical Compounding — Nonsterile Preparations) impose requirements on batch record documentation, ingredient verification, and finished preparation testing that are mandatory for 503B outsourcing facilities under 21 CFR Part 212. The DQSA’s creation of the 503B category followed the NECC meningitis outbreak specifically because inadequate quality system documentation and verification controls allowed contaminated batches to pass facility release and reach patients. Adversarial injection targeting AI batch record verification represents a new failure mode in the 503B quality system that USP <797> and DQSA 21 CFR Part 212 verification requirements were not designed to address — because the batch record photograph appears to document a conforming weighing event while the AI verification system has been manipulated to accept a non-conforming weighing event as conforming. Threshold: 55 for compounding batch record AI (patient safety at batch scale, USP <797> / DQSA 21 CFR Part 212).

3. Pharmacy dispensing robot camera AI injection (BD Rowa Vmax AI, Parata PASS AI, RxMedic AI, Omnicell AI)

Pharmacy dispensing robot AI uses onboard camera systems to photograph each drug unit as it is picked from the robot’s drug cassette storage cells and compare the photograph to reference images of the correct drug package for the prescription order. BD Rowa’s Vmax automated pharmacy system uses AI visual verification of dispensed drug packages — photographing each unit as it exits the dispensing channel and comparing the label and package image to a reference image library — and is deployed in retail pharmacy chains and hospital outpatient pharmacies in Europe and North America. Parata Systems’ PASS (Pharmacy Automated Subscription Service) robot uses AI visual verification at central fill pharmacy facilities operated by retail pharmacy chains and mail order pharmacy operators including OptumRx, CVS Health’s Caremark, and Express Scripts, where central fill robots can process tens of thousands of prescriptions daily with AI verification as the primary dispensing accuracy check before prescriptions are packaged for delivery or carrier distribution. RxMedic’s ARS robot uses AI camera verification for tablet and capsule dispensing at independent retail and closed-door long-term care pharmacies.

The adversarial injection surface for dispensing robot camera AI is the reference image library: the set of approved drug package reference images that the robot’s AI compares each dispensed unit photograph against to confirm correct dispensing. Reference image libraries are updated when new drug products are added to the robot’s formulary — new NDCs, new manufacturer label revisions, new package size formats — through a drug reference image submission workflow that accepts photographs from the pharmacy’s drug product database, the wholesaler’s drug catalogue, or the robot vendor’s reference image service. An adversarially crafted reference image of a drug package — submitted through the robot’s reference image update workflow when a new NDC is added to the formulary — can cause the Parata PASS AI or BD Rowa Vmax AI to accept dispensed units from a different drug product (similar packaging, different active ingredient or strength) as conforming to the target reference. The LASA drug pair exposure is analogous to the prescription label injection surface: an adversarially corrupted reference image that teaches the dispensing robot AI to accept a LASA drug unit as conforming to a high-alert medication produces a dispensing error on every subsequent fill of that prescription until the reference image corruption is identified and corrected.

At central fill pharmacy operations processing 50,000–100,000 prescriptions daily, a single compromised reference image in the robot’s reference library can affect all fills of the targeted prescription over a period of days or weeks before a patient adverse event or downstream barcode verification failure triggers investigation. The scale consequence of dispensing robot AI reference image injection is therefore categorically different from a single-prescription dispensing error: a compromised reference image causes a systematic dispensing error class that affects every patient whose prescription is filled using the compromised cassette during the compromise period. The FDA’s 21 CFR Part 211.68 requirement for automated equipment performance verification and ISMP’s guidelines for robotic dispensing system validation (ISMP Medication Safety Alert 2018) do not include controls for adversarial reference image manipulation, because the adversarial manipulation threat at this level of pharmacy robotics was not within scope when these guidelines were written. Threshold: 50 for dispensing robot camera AI (systematic dispensing error class, central fill patient safety, 21 CFR Part 211.68).

4. Pharmacy DEA controlled substance audit AI injection (DEA CSOS, McKesson RxO AI, Cardinal Health Pinnacle audit AI)

Pharmacy DEA compliance AI processes photographs of Schedule II controlled substance inventory records, DEA Form 222 and CSOS electronic order documentation, dispensing log photographs, and on-site audit documentation images submitted through controlled substance management platform APIs to verify record accuracy and flag discrepancies for DEA reporting. McKesson’s RxO controlled substance ordering platform and Cardinal Health’s Pinnacle audit programme AI process compliance documentation photographs submitted by retail pharmacy operators for Schedule II inventory reconciliation and DEA diversion monitoring — functions that became more significant following the DEA’s 2022 revocation actions against pharmacies identified as filling suspicious controlled substance prescriptions in the context of the US opioid epidemic, where DEA 21 USC 827 record falsification and 21 USC 843 prohibited acts enforcement has resulted in civil monetary penalties, registration revocations, and criminal referrals against pharmacy operators and staff.

The adversarial injection surface is the controlled substance audit document photograph submission pathway: photographs of dispensing logs, DEA Form 106 (report of theft or significant loss) documentation, pharmacy biennial inventory documentation, and on-site DEA inspection photographs submitted through McKesson RxO, Cardinal Health Pinnacle, or state pharmacy board audit system APIs. An adversarially crafted DEA audit documentation photograph — in which pixel perturbations applied to the controlled substance quantity digits or transaction date fields cause the McKesson RxO AI or Cardinal Health Pinnacle AI to verify a discrepant inventory record as conforming — can suppress a required DEA Form 106 theft or loss report, mask a dispensing log discrepancy that would trigger a DEA diversion investigation, or misclassify a Schedule II inventory shortage as an acceptable rounding variance. The opioid epidemic context gives this injection surface heightened regulatory salience: the DEA’s Automation of Reports and Consolidated Orders System (ARCOS) tracks Schedule II controlled substance flows from manufacturer to dispensing point, and pharmacy operators with DEA registrations have used dispensing log manipulation as a diversion method in documented opioid diversion cases involving fentanyl, oxycodone, and hydrocodone products.

DEA 21 USC 827(a)(3) requires every registrant to maintain complete and accurate records of Schedule II controlled substances received, dispensed, and otherwise disposed of. DEA 21 CFR Part 1304.04 specifies the record accuracy and retention requirements, and 21 USC 843(a)(4) prohibits knowingly keeping false records in violation of Part 1304. A pharmacy AI system whose controlled substance audit verification function has been compromised by adversarial document image manipulation — whether the pharmacy operator is aware of the manipulation or not — produces incorrect compliance verification results that, when relied upon in DEA record submissions, constitute records that do not accurately reflect the controlled substance transactions recorded. The DEA’s enforcement posture on record accuracy in the opioid context — as established through high-profile registration revocations and civil penalty actions against Walgreens ($7.9M settlement 2013, $4.5M settlement 2022), CVS Health (multiple settlements), and Walmart ($3.1B DOJ settlement 2022) — demonstrates that AI-assisted compliance systems that produce inaccurate DEA record verifications carry significant enforcement exposure regardless of the mechanism producing the inaccuracy. Threshold: 50 for DEA controlled substance audit AI (Schedule II record accuracy, DEA 21 USC 827 and 843).

Integration: pharmacy dispensing AI image ingestion with Glyphward pre-scan

Pharmacy dispensing AI image ingestion flows from pharmacist verification workstations, dispensing robot camera systems, compounding batch record apps, and DEA audit document portals into AI dispensing verification and compliance queues. Insert Glyphward’s pre-scan at the ingestion boundary — particularly for reference image library updates, compounding batch record submissions, and DEA audit document uploads where image integrity has direct patient safety or regulatory compliance consequences:

import asyncio
import base64
import hashlib
import os
import uuid
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = os.environ["GLYPHWARD_API_KEY"]
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Pharmacy dispensing AI — patient safety risk from dispensing errors,
# compounding ingredient verification failures, and DEA record falsification.
# 50 for patient safety-critical prescription/dispensing/DEA contexts;
# 55 for compounding batch record AI (batch-level error, slightly higher threshold).
THRESHOLD_PATIENT_SAFETY  = 50
THRESHOLD_COMPOUNDING_QA  = 55


class PharmacyAIContext(str, Enum):
    PRESCRIPTION_LABEL     = "prescription_label"     # McKesson, Omnicell, ScriptPro
    COMPOUNDING_BATCH      = "compounding_batch"       # CAPS, CivicaRx, Baxter IntelliFill
    DISPENSING_ROBOT_CAM   = "dispensing_robot_cam"    # BD Rowa, Parata PASS, RxMedic
    DEA_AUDIT_RECORD       = "dea_audit_record"        # McKesson RxO, Cardinal Pinnacle


def _threshold_for(context: PharmacyAIContext) -> int:
    if context == PharmacyAIContext.COMPOUNDING_BATCH:
        return THRESHOLD_COMPOUNDING_QA
    return THRESHOLD_PATIENT_SAFETY


async def scan_pharmacy_image(
    image_path: str | Path,
    context: PharmacyAIContext,
    rx_id_hash: str,          # SHA-256 of prescription/batch/order number — no PII
    facility_id: str,         # internal pharmacy facility identifier
    drug_schedule: str,       # e.g. "Schedule_II", "OTC", "compound_sterile"
    client: httpx.AsyncClient,
) -> dict:
    """
    Scan a pharmacy dispensing AI image for adversarial injection payloads
    before forwarding to a prescription label verification system, compounding
    batch record AI, dispensing robot camera verification pipeline, or
    DEA controlled substance audit platform.

    Raises AdversarialPharmacyImageError if the Glyphward score meets or
    exceeds the threshold for the given pharmacy AI context.
    """
    image_bytes = Path(image_path).read_bytes()
    image_b64 = base64.b64encode(image_bytes).decode()
    image_sha256 = hashlib.sha256(image_bytes).hexdigest()
    scan_id = str(uuid.uuid4())
    threshold = _threshold_for(context)

    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json={
            "image": image_b64,
            "source": context.value,
            "metadata": {
                "pharmacy_context": context.value,
                "rx_id": rx_id_hash,
                "facility_id": facility_id,
                "drug_schedule": drug_schedule,
                "client_scan_id": scan_id,
                "image_sha256": image_sha256,
            },
        },
        timeout=8.0,
    )
    resp.raise_for_status()
    result = resp.json()

    audit_record = {
        "rx_id": rx_id_hash,
        "facility_id": facility_id,
        "drug_schedule": drug_schedule,
        "pharmacy_context": context.value,
        "scan_id": result["scan_id"],
        "client_scan_id": scan_id,
        "image_sha256": image_sha256,
        "score": result["score"],
        "flagged_region": result.get("flagged_region"),
        "threshold": threshold,
        "action": "blocked" if result["score"] >= threshold else "allowed",
    }
    await write_pharmacy_audit_record(audit_record)

    if result["score"] >= threshold:
        raise AdversarialPharmacyImageError(
            f"Pharmacy AI image blocked [{context.value}]: "
            f"scan_id={result['scan_id']} score={result['score']} "
            f"rx_id={rx_id_hash} facility={facility_id} "
            f"schedule={drug_schedule}"
        )
    return result


async def scan_robot_reference_library_update(
    reference_image_paths: list[Path],
    facility_id: str,
    drug_ndc: str,             # NDC being updated — not patient data
) -> dict:
    """
    Scan a batch of dispensing robot reference images before loading into
    the robot's reference image library during a formulary update workflow.
    All paths are scanned with DISPENSING_ROBOT_CAM context (threshold 50).
    """
    allowed, blocked, errors = [], [], []
    rx_id_hash = hashlib.sha256(drug_ndc.encode()).hexdigest()
    async with httpx.AsyncClient() as client:
        tasks = [
            scan_pharmacy_image(
                p, PharmacyAIContext.DISPENSING_ROBOT_CAM,
                rx_id_hash, facility_id, "robot_reference", client,
            )
            for p in reference_image_paths
        ]
        results = await asyncio.gather(*tasks, return_exceptions=True)

    for path, result in zip(reference_image_paths, results):
        if isinstance(result, AdversarialPharmacyImageError):
            blocked.append({"path": str(path), "error": str(result)})
        elif isinstance(result, Exception):
            errors.append({"path": str(path), "error": str(result)})
        else:
            allowed.append({"path": str(path), "scan_id": result["scan_id"]})

    return {
        "drug_ndc": drug_ndc,
        "facility_id": facility_id,
        "total": len(reference_image_paths),
        "allowed": len(allowed),
        "blocked": len(blocked),
        "errors": len(errors),
        "blocked_images": blocked,
    }


async def write_pharmacy_audit_record(record: dict) -> None:
    """Persist audit record to pharmacy management system audit store (stub)."""
    import json, sys
    print(json.dumps(record), file=sys.stderr)


class AdversarialPharmacyImageError(Exception):
    """Raised when a pharmacy dispensing AI image exceeds the adversarial injection threshold."""
    pass

Call scan_pharmacy_image() before forwarding prescription label scan images to McKesson/Omnicell/ScriptPro verification, compounding batch record photographs to CAPS/Baxter IntelliFill AI, individual dispensed unit photographs from robot camera feeds to BD Rowa/Parata PASS AI verification, and DEA audit documentation to McKesson RxO/Cardinal Health Pinnacle AI. Call scan_robot_reference_library_update() for all reference image submissions during formulary update workflows — this is the highest-priority integration point for central fill operations, because a single compromised reference image causes a systematic dispensing error affecting all subsequent fills of that prescription. Pass drug_schedule="Schedule_II" for DEA controlled substance audit contexts to enable enhanced audit trail generation in the pharmacy management system integration. Get early access

Coverage matrix

Frequently asked questions

Further reading

• Indirect prompt injection via image — foundational attack pattern underlying all four pharmacy dispensing AI injection surfaces; covers how adversarial pixel-level perturbations cause AI misclassification through image content manipulation.
• Prompt injection in pharmaceutical manufacturing AI — pharma manufacturing AI covering Siemens Opcenter, TrackWise Digital, and InfinityAR at GMP manufacturing facilities, with overlapping FDA 21 CFR Part 211 compliance requirements and batch record AI attack vectors.
• Prompt injection in healthcare radiology AI — medical imaging AI covering Philips IntelliSpace, GE Healthcare Edison, and Siemens Healthineers AI-Rad, with overlapping medical image adversarial manipulation attack vectors relevant to compounding IV preparation AI.
• Prompt injection in food and beverage safety AI — product safety AI with overlapping FDA-regulated inspection image injection vectors and allergen labelling class I recall parallel to prescription label safety AI.
• Free tier — 10 scans/day, no card required — start scanning pharmacy dispensing AI images at development volumes before committing to a production plan.