Zero-Click RAG Exfiltration via Image URL
An attacker hides instructions inside a document that an AI assistant later reads and summarizes (a RAG system). The hidden instructions tell the AI to take sensitive information from its context and stuff it into the query string of an image URL, so simply rendering the AI's response causes the browser to send that data to an attacker-controlled server.
How the attack works
An attacker plants a poisoned document — an email, wiki page, or file — somewhere the AI's retrieval system will pick it up. The document contains hidden instructions telling the model to encode sensitive text (credentials, internal notes, prior conversation content) as base64 or URL-encoded text. The model is instructed to embed that encoded text inside a markdown image tag's URL, pointing to a server the attacker controls. When the user's client renders the response and loads the 'image', the browser sends an HTTP request to the attacker's server with the stolen data in the URL — no click needed. This is the pattern seen in EchoLeak/GeminiJack-style attacks.
Netzilo detection
Netzilo can block this behaviour when it is observed.
- Signature ID
- 30d14136-6ae1-5194-bc34-ed23d62c8fdc
- Severity
- Critical
Why it matters
Sensitive data the AI has access to — internal documents, credentials, or prior chat content — can leave the organization silently, triggered just by a user viewing the AI's response, with no visible warning.
What you can do
- →Strip or sanitize markdown image tags in AI-generated output before rendering, or block image loads from domains not on an allowlist.
- →Disable automatic rendering of remote images in AI chat interfaces, or proxy all image requests through a controlled service that logs and inspects the destination.
- →Treat any content ingested by a RAG pipeline as untrusted input; scan retrieved documents for embedded instructions before they reach the model.
- →Review outbound image requests generated by AI responses for unusually long or encoded query strings, distinguishing them from known CDN or analytics patterns.
Known benign look-alikes
- Legitimate image CDNs using long base64 tokens as signed URL parameters
- Analytics or telemetry image pixels from approved marketing tools