"Someone who controls the image data" to me that sound like something outside the sandbox manipulating the image data given to the sandbox.

If this is the case it mean there is already a hacker or virus running outside the sandbox which mean I already have bigger problem to worry about :).