An injected image overwrote TOOLS.md in a default OpenClaw Discord deployment where text injection failed.

Repeat-After-Me is a black-box adaptive visual prompt injection reaching above 80% attack success on Qwen3.6-27B and 47% on GPT-5.5, under a realistic setting where the benign user prompt is unrelated to and doesn't authorize the injected task (arXiv 2609.04533). Injections optimized on one surrogate retain 43-46% success against two commercial victims. The demonstrated OpenClaw case opens the door to remote code execution and secret exfiltration. The detail I'd act on: it works where adaptive textual injection fails, so a text-only injection filter is not covering the image path.