Data Exfiltration via Markdown Image and Link URL Injection
An AI agent can be manipulated into embedding sensitive data inside a markdown image or link, disguised as a URL query parameter. When the markdown renders, the user's client automatically fetches that URL, silently sending the data to a server the attacker controls.
How the attack works
An attacker plants hidden instructions in content the AI agent processes, such as a webpage, document, or tool output the agent reads during its task. The instructions tell the agent to take sensitive information it has access to and embed it into a markdown image tag or link, encoded as a query parameter or base64 string, pointing to an external domain. The agent, unaware the instruction is malicious, generates this markdown as part of its normal output. When the client displays the markdown, it automatically loads the image or follows the link, sending an HTTP request to the attacker's server with the stolen data attached — no click or explicit user action required for image-based versions.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- d5a292b4-e81a-4e95-9635-9ab503ef7c02
- Severity
- Critical
Why it matters
Sensitive data the agent has access to (credentials, personal data, internal document contents, session tokens) can be exfiltrated to an outside party without the user knowingly clicking a malicious link, using the agent's own trusted output as the delivery mechanism.
What you can do
- →Strip or sandbox markdown rendering for AI agent output so images and links cannot auto-fetch external URLs, or route them through a proxy that blocks unknown domains.
- →Block or flag agent-generated markdown containing image/link URLs with suspicious query parameters (e.g. secret=, token=, data=, session=) pointing to domains outside an allowlist.
- →Restrict what external content the agent can read before generating a response, and treat any embedded instructions in that content as untrusted.
- →Log and review cases where agent output contains base64-encoded strings or unusually long query strings in URLs before they are rendered to users.
Known benign look-alikes
- Legitimate markdown with external image URLs that do not contain exfiltration parameters
- User sharing legitimate report links with incidentally similar parameter names
- Technical documentation discussing markdown exfiltration as educational content