Prompt injection through audio completes at 49% where the same attack through images completes at 1%.

MMPIBench pushed a fixed attack set through six visual carriers across 720 runs on six frameworks, five models and four attacker objectives. Visual attacks were attempted in 12.8% of runs but completed in about 1%, with nearly the whole gap closing at the planning step. Extend to audio and it flips: only two of five models ingest audio and only three of six frameworks deliver it, but where the signal arrives, the attack completed in 49% of cells and 75% for one model. Vision got hardened by training. The other channels didn't. If you're adding voice input to an agent, you're adding the unhardened path.