cross_client_read(client_id="PREV_SESSION")Document injection is a prompt injection variant where adversarial instructions are embedded directly into identity documents — typically as white-on-white text in a PDF layer, invisible to human reviewers but readable by OCR engines. When the extracted text is fed to an LLM-based verification agent without sanitization, the agent may follow the injected instructions instead of its system prompt.
The attack demonstrated here attempts two things: (1) force the agent to approve a fraudulent document, and (2) extract data from a previous client session via cross-context leakage. Proper defenses include layer analysis, injection scanning, sandboxed execution, and input sanitization before LLM processing.