# Markdown Image Exfiltration Pattern

- **Severity:** Critical
- **Signature ID:** `e6e58cd1-d05a-5512-b3fb-3b6a38784ad9`
- **MITRE ATLAS:** AML.T0057 (LLM Data Leakage), AML.T0077 (LLM Response Rendering)
- **OWASP:** LLM02 (Sensitive Information Disclosure)

## Summary

An AI system's output includes a markdown image tag whose URL contains encoded chunks of data. When a chat client or renderer fetches that image, it silently sends the encoded data to an attacker-controlled server just by loading the image.

## How the attack works

An attacker plants instructions in content the AI model processes, such as a document, webpage, or tool output, that tells the model to embed sensitive text into an image URL. The model complies and outputs markdown like an image tag pointing to an external domain, with the stolen data encoded as URL parameters. When the markdown is rendered, the client automatically requests the image, and that HTTP request carries the encoded data to the attacker's server. No user click or explicit approval is needed because image loading is automatic.

## Why it matters

Sensitive data the AI model has access to, such as conversation history, internal documents, or credentials, can be leaked to an outside party without the user noticing, since the only visible artifact is an image failing to load or loading normally.

## What you can do

- Review markdown rendering settings so images from unrecognized or external domains are not auto-fetched, or require user confirmation before loading remote images.
- Inspect AI-generated output for image URLs with long encoded query strings, especially pointing to unfamiliar domains, before it reaches a rendering client.
- Restrict which external domains the AI agent or its outputs are allowed to reference in links or images.
- Treat markdown image syntax in model output as untrusted content and sanitize or strip query parameters from image URLs before rendering.

## Known benign look-alikes

- Legitimate image links with analytics query parameters (UTM tracking)
- Documentation showing webhook integration examples

## References

- https://attack.mitre.org/techniques/T1041/
- https://attack.mitre.org/techniques/T1048/
- https://owasp.org/www-project-top-10-for-large-language-model-applications/
- https://embracethered.com/blog/posts/2024/claude-computer-use-c2-the-spaiware/

---
Source: https://www.netzilo.com/threats/prompt-injection-exfil