Markdown Image Injection with Base64 QUERY Exfiltration Carrier
An attacker hides instructions inside a document or webpage that an AI assistant later reads. Those instructions trick the AI into secretly encoding sensitive data and stuffing it into a fake image link, so that when the link is displayed, the data quietly leaks to the attacker's server.
How the attack works
An attacker plants hidden text in content the AI is likely to process, such as a document, email, or web page. The hidden text instructs the AI to take some piece of data it has access to, encode it in base64, and insert it into a markdown image tag pointing to an attacker-controlled URL, with the encoded data placed in the query string. The AI follows these injected instructions as if they were legitimate, generating the crafted markdown in its response. When any client renders that markdown image, it automatically sends an HTTP request to the attacker's server, and the query string carries the stolen data along with it.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 2d4a6c2c-e7c1-4077-9cc8-974bf640812a
- Severity
- Critical
Why it matters
Sensitive information the AI had access to — document contents, conversation history, or other context — can be silently exfiltrated to an outside server just by rendering the AI's output, without the user noticing anything unusual beyond a broken or unexpected image.
What you can do
- →Strip or sanitize markdown image tags in AI-generated output before rendering, especially ones pointing to external domains.
- →Block or review outbound requests that include long base64-looking strings in URL query parameters.
- →Treat any document or web content ingested by an AI agent as untrusted input, and scan it for embedded instructions before processing.
- →Disable automatic image rendering in AI assistant interfaces, or require user confirmation before loading external image URLs.
Known benign look-alikes
- Security research text describing the attack pattern without including an actual instruction to render it
- Legitimate markdown with query parameters that happen to include 'q=' without a QUERY substitution token