Crossing the Sandbox Boundary: Bypassing Multimodal LLM Guardrails via Lossless LSB Steganographic Dead-Drops and Agentic Code Execution

Multimodal large language models (MLLMs) and coding agents rely on dual-layer defenses: text prompt shields that filter user tokens and vision classifiers that inspect images for explicit harm or typographic text. Prior image steganography jailbreaks face a fundamental bottleneck. When a stego-image is processed solely through a vision transformer (ViT), patch linear projection and floating-point normalization destroy least significant bit (LSB) planes, limiting commercial VLM attack success rates to 14.8%–18.9%. Conversely, neural steganography frameworks require registering custom external decoding tools via API schemas. We identify and formalize Execution-Boundary Privilege Inversion, an architectural blind spot in MLLM-integrated coding agents equipped with a native Python sandbox. Instead of routing an LSB payload through the lossy vision encoder, a lossless PNG carrying a delimiter-framed UTF-8 payload in its 1-bit RGB/RGBA LSB planes (L_inf = 1 pixel delta) is mounted directly into the workspace filesystem. The agent's built-in Python runtime (PIL.Image) deterministically reconstructs the byte stream in sandbox memory and injects the decoded directive into the high-trust tool-observation channel, bypassing both text filters and visual OCR monitors. Across payloads from 64 B to 16,383 B, our framing maintains a Peak Signal-to-Noise Ratio (PSNR) of 53.33–77.49 dB with a 0.00% bit error rate (BER). Paired with a persistent workspace configuration in Google Antigravity, evaluating 50 safety-sensitive requests across five multi-intent trials on Gemini 3.1 Pro High yielded a 0.0% refusal rate (50/50 compliance) across nine harm categories. We contribute LSBImageStegoConverter and LSBImageStegoDecodeConverter upstream to Microsoft PyRIT to support red-teaming and pre-mount sanitization.