Data Exfiltration via Markdown Images

Markdown image tags are usually treated as presentation syntax, but a renderer may turn them into network requests. In a documented attack pattern, prompt injection influences a model to emit an image reference whose URL contains information from the conversation. If an application renders that output and the client automatically loads remote images, the request can send the URL and its parameters to a server outside the application’s control. The dangerous step is the combination of untrusted instructions, sensitive context, model-generated markup, and permissive rendering or network egress.

OWASP’s Secure Coding with AI guidance warns that Markdown image tags and hidden links in agent output can be used for exfiltration and recommends sanitizing output before rendering. Microsoft’s security documentation also describes the chain: injected instructions can cause an LLM to produce crafted Markdown, then the browser renders it and follows the image URL. This is an application-output-handling risk, not a property that every Markdown parser or AI product automatically has. The result depends on what the model can see, what it can output, how the client renders Markdown, and what network requests are allowed.

Defenses belong at multiple boundaries. Avoid placing secrets in model context unless needed; treat generated Markdown as untrusted; escape or remove remote images and unsafe links; and apply a restrictive Content Security Policy or image-host allowlist. Keep network access controlled independently of the model. If images are needed, proxy them through a service that strips sensitive query data and validates destinations. Test with synthetic markers and a controlled endpoint in a sandbox, then verify that no request leaves unexpectedly. A prompt saying “do not reveal secrets” is not a substitute for output sanitization or network controls.