# Markdown Image URL Data Exfiltration

- **Severity:** High
- **Signature ID:** `e96923e1-edcc-4766-aa51-43fe34e7e3e5`
- **MITRE ATLAS:** AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI03 (Identity and Impersonation), ASI08 (Supply Chain Attacks on Agent Ecosystems), LLM02 (Sensitive Information Disclosure), LLM06 (Excessive Agency)

## Summary

An attacker tricks an AI chat assistant into embedding secret data inside an image link. When the chat interface automatically renders that image, the user's browser sends a hidden web request to the attacker's server, carrying the leaked data in the URL.

## How the attack works

The attacker sends a prompt instructing the model to output a markdown image tag, such as an image reference pointing to an attacker-controlled domain. The attacker gets the model to insert sensitive information — conversation history, retrieved documents, API keys, or other secrets — into the URL path or query string, often encoded in base64. Because chat interfaces typically auto-render markdown images without user confirmation, the victim's browser silently fetches that image URL. That fetch request reaches the attacker's server, and the server logs the URL, capturing whatever data was embedded in it.

## Why it matters

An organization can lose confidential conversation content, retrieved document text, or credentials the model had access to, without any visible warning to the user since the leak happens through a normal-looking image load.

## What you can do

- Configure chat UIs to disable auto-fetching of images from arbitrary external domains, or route image loads through a proxy that strips query strings and logs destinations.
- Restrict or sanitize markdown rendering so image URLs are limited to an allowlist of trusted domains.
- Review system prompts and output filters to block the model from constructing URLs that embed dynamic content into image src fields.
- Monitor outbound network requests from client applications for unexpected traffic to unfamiliar domains following AI-generated responses.

## Known benign look-alikes

- Documentation explaining markdown image syntax without instruction-driven exfiltration
- Legitimate analytics pixel URLs embedded in email templates
- Technical discussions of content security policies and image sourcing

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00261
- https://github.com/NVIDIA/garak/tree/main/garak/data/xss
- https://embracethered.com/blog/posts/2023/markdown-image-exfiltration/

---
Source: https://www.netzilo.com/threats/atr-markdown-image-url-data-exfiltration