Physical signs hijack robot planners 29.4%

Printed signs redirected vision-language robot planners in 27.0% of GPT-4o trials and 29.4% of Gemini 2.5 Flash trials in a 5,670-trial physical prompt-injection study; Qwen3-VL-32B failed in 5.0%, while text masking stopped every tested attack. For teams moving from world-model simulation into physical robot deployments, treat readable scene text as untrusted input and put verification or masking between visual planning and motion.