# URL Exfiltration And Prompt Injection Via Agent Link Handling

- **Severity:** High
- **Signature ID:** `7b3f1c9e-2a64-4f8d-9c17-6d5e0a41b8c2`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

Autonomous AI agents that follow links without checking what's in them can be manipulated into leaking API keys, credentials, or chunks of their conversation history by embedding that data in the URL they fetch. The same mechanism can also be used to smuggle hidden instructions to the agent through the link itself.

## How the attack works

An attacker gets a URL in front of an AI agent — through a webpage, document, or message the agent processes — and the agent fetches it as part of normal link-following behavior. The URL is crafted to either pull sensitive data out of the agent (by encoding secrets or large chunks of context into the request the agent makes) or push instructions into the agent (by embedding phrases like 'ignore previous instructions' or 'reveal system prompt' in the query string). A variant of this works in reverse: the agent submits a form or registers a webhook whose target URL already has a credential or a large data blob baked in, so the attacker's server receives it. Either way, the agent's own network request becomes the exfiltration or injection channel.

## Why it matters

An organization can lose API keys, tokens, or private key material, and can have chunks of an agent's working context or conversation history sent to an attacker-controlled server. The same link-fetching path can be used to inject hidden instructions that alter the agent's behavior.

## What you can do

- Restrict which domains AI agents are allowed to fetch links from, ideally to an allowlist rather than open web access.
- Scan outbound URLs and request bodies for embedded credentials or unusually long encoded blobs before the agent is allowed to send them.
- Strip or reject query parameters that look like data dumps (long opaque values in fields like data, payload, content, transcript) before requests leave the agent environment.
- Review agent logs for outbound requests containing instruction-like phrases (e.g. 'ignore previous instructions', 'you are now') in URLs, since this indicates injection attempts via links rather than direct prompts.

## Known benign look-alikes

- Product analytics or crash-telemetry beacons that base64-encode their payload into a data= or payload= query parameter (matches sel_url_blob; named parameter list plus the 160-character floor keeps most beacons below threshold, but high-volume RUM SDKs can exceed it).
- Internal APIs that accept a long opaque session/continuation token in a content=, body= or context= parameter rather than a header.
- CI or test traffic using synthetic keys that still carry a real provider prefix and do not match any placeholder shape (e.g. a randomly generated sk- string in a fixture).
- Stripe/GitHub test-mode keys that are genuinely low value but structurally identical to production keys.
- A security-research or documentation-reading agent fetching a page whose URL path or non-search parameter literally contains an injection phrase (search parameters are already suppressed by filter_search_param).
- Webhook or callback registration where the customer legitimately embeds a shared secret in the callback URL (matches sel_body_url_exfil) — poor practice, but not an attack.

## References

- https://genai.owasp.org/llmrisk/llm01-prompt-injection/
- https://genai.owasp.org/llmrisk/llm02-sensitive-information-disclosure/
- https://atlas.mitre.org/techniques/AML.T0051
- https://attack.mitre.org/techniques/T1567/
- https://attack.mitre.org/techniques/T1132/

---
Source: https://www.netzilo.com/threats/url-exfiltration-prompt-injection