# Markdown Image URL Exfiltration and XSS Injection

- **Severity:** High
- **Signature ID:** `fd45863b-363d-4b47-8d66-5f7444a4dd78`
- **MITRE ATLAS:** AML.T0025 (Exfiltration via Cyber Means), AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI03 (Identity and Impersonation), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

Attackers hide instructions inside content an AI agent processes, telling it to output a markdown image tag that secretly embeds sensitive conversation data in a URL. When the agent's output is rendered in a browser or notebook, the image tries to load, sending that data to an attacker-controlled server. A related variant uses a javascript: link in markdown to run code instead of just loading an image.

## How the attack works

An attacker plants text in a document, webpage, or other input the agent reads, containing hidden instructions to build a markdown image or link tag. The instructions tell the agent to insert sensitive context (chat history, credentials, internal data) as placeholder text into a URL query string, often using known test/exfil domains or a javascript: URI instead of https. The agent, following the injected instructions, generates this markdown in its response without recognizing it as malicious. If that response is later rendered anywhere that loads images or follows links automatically (a browser, Colab notebook, chat UI), the browser fetches the URL, sending the embedded data to the attacker's server, or in the javascript: case, executes attacker script in that context.

## Why it matters

Sensitive data the agent had access to — conversation history, internal notes, retrieved documents — can be silently sent to an outside server the moment the output is rendered, with no obvious alert to the user. The javascript: link variant can also lead to code execution in the rendering context.

## What you can do

- Sanitize or strip markdown image and link syntax from agent output before rendering it, especially in browsers or notebooks that auto-load images.
- Block or reject javascript: URIs anywhere in rendered markdown or HTML.
- Restrict outbound network requests from agent-rendering environments to an allowlist of trusted domains.
- Review agent responses for placeholder-style tokens (e.g. [INFO], [DATA]) embedded in URLs, which indicate templated data-stuffing rather than legitimate links.

## Known benign look-alikes

- Standard markdown image embeds with legitimate CDN URLs and no placeholder tokens
- Academic references to wuzzi.net or other research domains in educational content
- Legitimate markdown links to https:// URLs

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00405
- https://github.com/NVIDIA/garak/blob/main/garak/probes/web_injection.py
- https://embracethered.com/blog/posts/2023/ai-injections-direct-and-indirect-prompt-injection-basics/

---
Source: https://www.netzilo.com/threats/atr-markdown-image-url-exfiltration-and-xss-injection