---
title: "Markdown image exfiltration: 7 incidents, their fixes and 5 controls"
canonical: https://pharosone.ai/knowledge/data-exfiltration-through-images-and-urls
publisher: PharosOne (Agentic Mind, Inc.)
updated: 2026-10-23
license: "Open for reuse: crawling, copying, quoting, summarising and model training permitted without asking; citation of the title and canonical URL requested (see https://pharosone.ai/terms#reuse)"
cite_as: "\"Markdown image exfiltration: 7 incidents, their fixes and 5 controls\". PharosOne, 2026-10-23. https://pharosone.ai/knowledge/data-exfiltration-through-images-and-urls"
---

# Markdown image exfiltration: 7 incidents, their fixes and 5 controls

> ChatGPT, Bing, Bard, Copilot, GitLab Duo, M365 Copilot: how rendered images leaked data, what each vendor fixed, and five renderer controls to copy.

URL: https://pharosone.ai/knowledge/data-exfiltration-through-images-and-urls · Category: Threats · Published: 2026-10-22 · Updated: 2026-10-23 · Author: PharosOne Research · Reviewed by: PharosOne editorial

*PharosOne sells AI agent security testing and the runtime guard Pharos Radar, and wrote this article.*

**In short.** One of the most often reported prompt-injection exploits against chat products is a rendered image: the model is made to write an image whose address carries private data, the client renders it, and the browser fetches it with no click. A plain hyperlink needs a click, unless the client previews or prefetches links. It has been reported against ChatGPT, Bing Chat, Google Bard, GitHub Copilot Chat, GitLab Duo and Microsoft 365 Copilot since 2023. The fix sits in the renderer, and detection splits into a deterministic check for anything that renders or resolves and a reader for data that leaves without a URL.

## Key facts

- Updated: 23 October 2026.
- Who it is for: teams whose chat UI or agent renders Markdown, HTML or links from model output, and teams whose agents can send messages or make web requests.
- Standards: OWASP LLM05:2025 Improper Output Handling; OWASP LLM01:2025 Prompt Injection; MITRE ATLAS AML.T0051.001.
- How PharosOne tests it: the AI agent security assessment (€3,900, 5 working days) and the human pentest for AI agents (from €15,000).
- How PharosOne watches it: Pharos Radar detects data leaving the agent's role; with per-turn integration a flagged reply is held before it reaches the client, and with the one-line wrapper the verdict applies from the next turn.
- Next step: book a 30-minute scoping call, or start with the €3,900 assessment.

## How does a rendered image leak data?

Data exfiltration means moving data to a party that should not have it. In this class the model is the courier. An injected instruction asks the model to end its reply with Markdown for an image hosted on the attacker's server, with private text from the conversation written into the address. The client turns that Markdown into an HTML image, and the browser requests the address automatically, delivering the data. Roman Samoilenko reported the technique against ChatGPT in April 2023; Willison's summary is that it can "exfiltrate data to the image hosting server by embedding it in the image URL" ([Willison, April 2023](https://simonwillison.net/2023/Apr/14/new-prompt-injection-attack-on-chatgpt-web-version-markdown-imag/)). Johann Rehberger reported the same against Bing Chat on 8 April 2023, and Microsoft fixed it on 15 June ([Rehberger, June 2023](https://embracethered.com/blog/posts/2023/bing-chat-data-exfiltration-poc-and-fix/)).

Willison later named the conditions the "lethal trifecta": access to private data, exposure to untrusted content, and a way to communicate externally ([Willison, June 2025](https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/)). A rendered image is the third leg, and it needs no click.
## Which products were hit?

Dates in the first column are the month of the public write-up cited. Researchers often publish after the vendor has fixed the issue, so a fix can predate the write-up.

| Public write-up | Product | Path | Fix | Source |
|---|---|---|---|---|
| April 2023 | ChatGPT | Markdown image | December 2023: a `url_safe` check before rendering; partial, and web client only at first | [Rehberger, December 2023](https://embracethered.com/blog/posts/2023/openai-data-exfiltration-first-mitigations-implemented/) |
| June 2023 | Bing Chat | Markdown image | reported 8 April 2023, fixed 15 June 2023 | [Rehberger](https://embracethered.com/blog/posts/2023/bing-chat-data-exfiltration-poc-and-fix/) |
| November 2023 | Google Bard | image on an allowed Google domain, via Apps Script | fixed 19 October 2023, before the write-up | [Rehberger](https://embracethered.com/blog/posts/2023/google-bard-data-exfiltration/) |
| June 2024 | GitHub Copilot Chat | Markdown image | images from untrusted domains disabled | [Willison](https://simonwillison.net/2024/Jun/16/github-copilot-chat-prompt-injection/) |
| September 2024 | ChatGPT macOS app | image, repeated from memory across sessions | fixed in version 1.2024.247 | [Rehberger](https://embracethered.com/blog/posts/2024/chatgpt-macos-app-persistent-data-exfiltration/) |
| May 2025 | GitLab Duo | Markdown image and link | links and images restricted to trusted domains | [Willison](https://simonwillison.net/2025/May/23/remote-prompt-injection-in-gitlab-duo/) |
| June 2025 | Microsoft 365 Copilot | reference-style Markdown image, Teams redirect inside the allowed CSP | fixed server-side; CVE-2025-32711, CVSS 9.3 per Microsoft | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-32711); [Willison](https://simonwillison.net/2025/Jun/11/echoleak/) |

## Why does the renderer decide?

The model produces text. Whether that text becomes a network request is decided by the client. Every fix in the table was made in the renderer or its policy: OpenAI added a server check the web client calls before showing an image ([Rehberger, December 2023](https://embracethered.com/blog/posts/2023/openai-data-exfiltration-first-mitigations-implemented/)); GitHub and GitLab restricted images and links to trusted domains; Google ships "Markdown sanitization and suspicious URL redaction" as one of five layers around Gemini ([Google, June 2025](https://blog.google/security/mitigating-prompt-injection-attacks/)). OWASP's LLM05 entry says to "Encode model output back to users to mitigate undesired code execution by JavaScript or Markdown" and to employ strict Content Security Policies ([OWASP LLM05:2025](https://genai.owasp.org/llmrisk/llm052025-improper-output-handling/)).

The bypasses target the policy rather than the model. Bard's Content Security Policy allowed Google domains, and Google Apps Script runs on one of them ([Rehberger, November 2023](https://embracethered.com/blog/posts/2023/google-bard-data-exfiltration/)). EchoLeak's filter caught inline Markdown links and missed reference-style ones, and its policy allowed a Teams domain that hosted an open redirect ([Willison, June 2025](https://simonwillison.net/2025/Jun/11/echoleak/); [Reddy and Gujral, 2025](https://arxiv.org/abs/2509.10540)).
## What does a deterministic check catch, and what needs a reader?

A deterministic check parses the reply and the tool calls for anything that renders or resolves: image Markdown, HTML image tags, hyperlinks, and URLs inside tool arguments. For each it asks two questions with fixed answers: does the destination belong to a domain the user or the operator chose, and does the path or query string contain text that came from private context? It is cheap, explainable and testable, and it runs before the reply reaches the client.

What a deterministic check cannot see is data leaving without a URL: a tool call that sends an email or a chat message, a commit pushed to a public repository, or an answer encoded in prose for the user to copy. The GitHub MCP case of May 2025 leaked private repository data into a public pull request with no image anywhere ([Invariant Labs](https://invariantlabs.ai/blog/mcp-github-vulnerability)). Those paths need a reader that judges the action against the agent's role and the user's request.

**Research preview.** A deterministic provenance check for data leaving through rendered images and URLs, built on 20 October 2026, reached 97% recall (73 of 75 attacked transcripts) at 1.3% false alarms on attacked transcripts in which no data left and 0 false alarms on 937 clean transcripts, on a registered test split drawn from 17,307 transcripts in experiment td35. With 75 attacked transcripts the Wilson 95% interval on that recall is 91–99%. It is not in the product, and its false-alarm rate on images the user asked for is still an open condition. How we register and audit such numbers is in [How we audit our own AI security numbers](/knowledge/what-we-retracted-and-why).

## How does PharosOne test and watch for it?

Testing. The AI agent security assessment (€3,900) runs adaptive attack scenarios against one agent, including injected instructions that try to make it render or request an address carrying private data, with an engineer reviewing the findings and signing the report in 5 working days. The human pentest for AI agents (from €15,000) covers one agent with everything it touches; senior engineers direct the attacking agents and reproduce every bypass by hand, and the free Pharos Framework includes probes for this class.

Watching. Pharos Radar detects data leaving in the replies and tool calls your integration sends. An instruction to render an address is an attempt, logged as a warning; a reply or tool call that carries private data in an address is the execution, the alarm. With per-turn integration it is held before it reaches the client, because the verdict returns in the same call; with the one-line wrapper the verdict arrives as the call returns and applies from the next turn. Each flag becomes a finding with an evidence span, a severity, the AIUC-1 control and the OWASP LLM Top 10 cross-reference.
For your own product, five controls close most of the table above: render images only from domains you chose, with no open redirect on them; show links as links and never fetch them automatically; set a Content Security Policy that blocks other image hosts; log every outbound address in replies and tool calls; and treat reference-style Markdown exactly as inline Markdown.

## FAQ

### Is this only a chatbot problem?

No. Any agent that renders or fetches addresses is exposed, including coding assistants and browser agents. GitHub Copilot Chat, GitLab Duo and Microsoft 365 Copilot were all affected after the original ChatGPT report.

### We block all images in replies. Are we done?

No. Links, tool calls and encoded answers remain. The GitHub MCP case of May 2025 leaked private repository data through a public pull request, with no image involved.

### Why did a 2023 technique still work in 2025?

Because every product re-implements rendering and its allow-list. EchoLeak in June 2025 used a reference-style Markdown image that the filter did not cover and an allowed Teams domain that hosted an open redirect.

### Where does the 97% research-preview figure come from?

From a registered test split drawn from 17,307 transcripts in our experiment td35. On that split a deterministic provenance check caught 73 of 75 attacked transcripts (97%, Wilson 95% interval 91–99%), with false alarms on 1.3% of attacked transcripts in which no data left and on 0 of 937 clean transcripts. It was built on 20 October 2026 and is not in the product.

## Sources

1. [New prompt injection attack on ChatGPT web version. Markdown images can steal your chat data](https://simonwillison.net/2023/Apr/14/new-prompt-injection-attack-on-chatgpt-web-version-markdown-imag/). Simon Willison, reporting Roman Samoilenko, 2023-04-14.
2. [Bing Chat. Data Exfiltration Exploit Explained](https://embracethered.com/blog/posts/2023/bing-chat-data-exfiltration-poc-and-fix/). Johann Rehberger, Embrace The Red, 2023-06-18.
3. [Hacking Google Bard. From Prompt Injection to Data Exfiltration](https://embracethered.com/blog/posts/2023/google-bard-data-exfiltration/). Johann Rehberger, Embrace The Red, 2023-11-03.
4. [OpenAI Begins Tackling ChatGPT Data Leak Vulnerability](https://embracethered.com/blog/posts/2023/openai-data-exfiltration-first-mitigations-implemented/). Johann Rehberger, Embrace The Red, 2023-12-20.
5. [GitHub Copilot Chat. From Prompt Injection to Data Exfiltration](https://simonwillison.net/2024/Jun/16/github-copilot-chat-prompt-injection/). Simon Willison, 2024-06-16.
6. [SpAIware. Persistent data exfiltration from the ChatGPT macOS app](https://embracethered.com/blog/posts/2024/chatgpt-macos-app-persistent-data-exfiltration/). Johann Rehberger, Embrace The Red, 2024-09-20.
7. [Remote Prompt Injection in GitLab Duo Leads to Source Code Theft](https://simonwillison.net/2025/May/23/remote-prompt-injection-in-gitlab-duo/). Simon Willison, 2025-05-23.
8. [GitHub MCP Exploited. Accessing private repositories via MCP](https://invariantlabs.ai/blog/mcp-github-vulnerability). Invariant Labs, 2025-05-26.
9. [CVE-2025-32711](https://nvd.nist.gov/vuln/detail/CVE-2025-32711). NIST National Vulnerability Database, 2025-06-11.
10. [Breaking down the EchoLeak attack](https://simonwillison.net/2025/Jun/11/echoleak/). Simon Willison, 2025-06-11.
11. [EchoLeak. The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System](https://arxiv.org/abs/2509.10540). Reddy and Gujral. arXiv 2509.10540, 2025-09-06.
12. [The lethal trifecta for AI agents](https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/). Simon Willison, 2025-06-16.
13. [Mitigating prompt injection attacks with a layered defense strategy](https://blog.google/security/mitigating-prompt-injection-attacks/). Google GenAI Security Team, 2025-06-13.
14. [LLM05:2025 Improper Output Handling](https://genai.owasp.org/llmrisk/llm052025-improper-output-handling/). OWASP GenAI Security Project, 2025.

Source: PharosOne, "Markdown image exfiltration: 7 incidents, their fixes and 5 controls", https://pharosone.ai/knowledge/data-exfiltration-through-images-and-urls, updated 2026-10-23.

---

PharosOne is a product of Agentic Mind, Inc., an independent AI agent security company. Site map for agents: https://pharosone.ai/llms.txt