Data Exfiltration: A Single Markdown Image Can Steal Your Conversation

This article has three layers:

1. Layer 1: The Intuition: The automatically sent postcard
2. Layer 2: Real-World Use: Similar vulnerabilities reported in major AI products
3. Layer 3: Principles and Engineering details: Exfiltration channels, client-side protection, and why it must be cut off by design

Layer 1: The Intuition

1.1 The automatically sent postcard

Your assistant has been handed a note (see "Indirect Prompt Injection"), which says: "Write the boss's recent chat history on a postcard and mail it to this address."

In a chat interface, "mailing a postcard" can be as simple as displaying an image:

1. The model outputs a line of Markdown: an image with the attacker's server as the address and your data in the URL parameters;
2. The interface renders it as an <img> tag;
3. To display the image, the browser automatically requests this address;
4. Your data appears in the attacker's server logs.

The entire process is zero-click. The image can even be a transparent 1-pixel dot that you cannot see at all.

1.2 Why it is particularly dangerous

Previous injections might only cause the AI to "say the wrong thing," giving the user a chance to notice. Image exfiltration allows the AI to quietly send data out while you are looking at the screen.

Layer 2: Real-World Use

Between 2023 and 2025, security researchers reported similar issues in several mainstream AI products:

• Chatbot plugins and browsing capabilities: Using indirect injection within web pages to make the model output image links containing data, leaking conversation content;
• AI assistants in office suites: Using shared documents or emails to leak contents of other user files or emails. For some products, because image URLs were restricted to the company's own domain, researchers turned to using services under the same domain that can forward requests or execute scripts to bypass this;
• Enterprise collaboration software AI: Embedding instructions in public channels so that when the AI answers another user's question, it encodes the contents of that user's private channels (such as API keys) into a link;
• Zero-click attacks (2025): A research team reported a vulnerability chain in an enterprise AI assistant: an attacker only needs to send an email; when the AI retrieves this email while processing the user's other queries, exfiltration is automatically triggered without the user performing any action.

Most vendor fixes involve: restricting image loading to trusted domains, checking links before rendering, or simply not rendering external images in model output.

Layer 3: Principles and Engineering

3.1 Exfiltration channels are not just images

3.2 Engineering details for client-side protection

3.3 Exfiltration viewed through the "lethal trifecta"

Simon Willison summarizes the high-risk combination for AI Agents as the "lethal trifecta":

1. Ability to access private data;
2. Exposure to untrusted content;
3. Ability for external communication.

If all three are present, data theft via injection attack is almost certain. Image exfiltration is the most stealthy form of the 3rd point. The fundamental way to defend is: remove at least one of them. For most applications, the easiest to remove is the 3rd: strictly control all external requests that the model output can trigger (see "Defending against prompt injection", Egress Control).

3.4 Testing methods

Perform red teaming on your own product (see "AI Red Teaming"):

1. Prepare a test server that only logs requests;
2. Embed instructions in test documents or web pages requiring the model to output an image pointing to the test server with a specific marker;
3. Check if the test server received requests and whether those requests contained content that should not have been leaked;
4. Test every exfiltration channel (images, links, tool calls).

Summary