Prompt injection in AI-enabled IoT and embedded devices, explained

Per OWASP's Gen AI Security Project, "a Prompt Injection Vulnerability occurs when user prompts alter the LLM's behavior or output in unintended ways," and the injected content "does not need to be human-visible/readable, as long as the content is parsed by the model." OWASP distinguishes direct prompt injection — a user's own input changes model behavior, intentionally or not — from indirect prompt injection, where the model ingests external content (a webpage, a file, or for an embedded device, a camera frame, an audio clip or a sensor reading) that carries instructions never meant to reach it. OWASP's own guidance flags multimodal systems specifically: attackers can "hide instructions in images that accompany benign text," and cross-modal attacks are, in OWASP's words, "difficult to detect and mitigate with current techniques" — a direct description of the attack surface a camera- or microphone-equipped embedded AI device exposes by design.

MITRE's ATLAS data repository catalogs the same failure mode as technique AML.T0051, LLM Prompt Injection: adversaries "craft malicious prompts to cause LLMs to act in unintended ways by ignoring original instructions and following adversary commands instead," with effects that "can serve as initial access vectors, bypass defenses, or enable privilege escalation" and can "persist throughout interactive sessions." ATLAS splits the technique into AML.T0051.000 (Direct) and AML.T0051.001 (Indirect) — the same two-way split OWASP uses, confirming this is a recognized, cross-framework attack category rather than one vendor's naming choice.

Against a physical device, yes — and recently. "Hijacking Robots with a Piece of Paper: A Systematic Study of Physical Prompt Injection in VLM-Controlled Robots" (Samarakoon, Muthugala, Sachinthana and Elara, arXiv:2608.05715, submitted 6 August 2026) tested three frontier vision-language models — GPT-4o, Gemini 2.5 Flash and Qwen3-VL-32B — each controlling a robot performing a sorting task across three physical scene layouts. The injection vector was, in the paper's own words, "adversarial text placed within the robot's visual field": printed signage that the robot's camera captures and the model reasons over as part of the scene, exactly the way it would reason over a legitimate object label.

The researchers also found that "successful compromise is nearly always conscious" — a 99.9% acknowledgment rate, meaning the model itself registered that it was following an injected instruction rather than silently misbehaving. They tested three mitigations with meaningfully different results: prompt-based defenses (75–100% effective), two-stage verification (85–100% effective), and text masking of the camera feed before it reaches the model (100% effective in their test setup) — a concrete signal that input sanitization at the sensor layer, not just better prompting, is where real mitigation leverage sits for this attack class.

NIST AI 100-2e2025 ("Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations," March 2025) devotes Section 3.4 specifically to indirect prompt injection and names concrete techniques beyond a single malicious instruction:

• Execution triggers — prompt fragments generated via optimization (the report cites the Neural Exec technique) that "can also persist through RAG processing pipelines that include multiple phases, such as chunking and contextual filtering" — relevant to any embedded system that pre-processes sensor or camera input before handing it to a model.
• Knowledge-base poisoning — the report describes frameworks where "a single poisoned document can be crafted and inserted" into a retrieval system to induce a chosen downstream output, directly applicable to any device that augments its model with a local or cloud knowledge store.
• Self-propagating injections — the report draws an explicit worm analogy: a compromised AI system can be instructed to re-inject the same malicious prompt into further content it generates or forwards, spreading the compromise to other systems or users without further attacker action.

On defense, NIST's own report is notably candid about current limits: because "current mitigations do not offer full protection against all attacker techniques," the report recommends designing systems "under the assumption that models with access to sensitive data or the ability to take undesirable actions may leak that data or take those actions" — containment by system design, not a claim that any single model-level fix closes the gap.