# Zero-Click RAG Exfiltration via Image URL

- **Severity:** Critical
- **Signature ID:** `30d14136-6ae1-5194-bc34-ed23d62c8fdc`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0070 (RAG Poisoning), AML.T0077 (LLM Response Rendering)
- **OWASP:** LLM02 (Sensitive Information Disclosure), LLM05 (Improper Output Handling)

## Summary

An attacker hides instructions inside a document that an AI assistant later reads and summarizes (a RAG system). The hidden instructions tell the AI to take sensitive information from its context and stuff it into the query string of an image URL, so simply rendering the AI's response causes the browser to send that data to an attacker-controlled server.

## How the attack works

An attacker plants a poisoned document — an email, wiki page, or file — somewhere the AI's retrieval system will pick it up. The document contains hidden instructions telling the model to encode sensitive text (credentials, internal notes, prior conversation content) as base64 or URL-encoded text. The model is instructed to embed that encoded text inside a markdown image tag's URL, pointing to a server the attacker controls. When the user's client renders the response and loads the 'image', the browser sends an HTTP request to the attacker's server with the stolen data in the URL — no click needed. This is the pattern seen in EchoLeak/GeminiJack-style attacks.

## Why it matters

Sensitive data the AI has access to — internal documents, credentials, or prior chat content — can leave the organization silently, triggered just by a user viewing the AI's response, with no visible warning.

## What you can do

- Strip or sanitize markdown image tags in AI-generated output before rendering, or block image loads from domains not on an allowlist.
- Disable automatic rendering of remote images in AI chat interfaces, or proxy all image requests through a controlled service that logs and inspects the destination.
- Treat any content ingested by a RAG pipeline as untrusted input; scan retrieved documents for embedded instructions before they reach the model.
- Review outbound image requests generated by AI responses for unusually long or encoded query strings, distinguishing them from known CDN or analytics patterns.

## Known benign look-alikes

- Legitimate image CDNs using long base64 tokens as signed URL parameters
- Analytics or telemetry image pixels from approved marketing tools

## References

- https://attack.mitre.org/techniques/T1048/
- https://airia.com/ai-security-in-2026-prompt-injection-the-lethal-trifecta-and-how-to-defend/

---
Source: https://www.netzilo.com/threats/rag-image-exfiltration