Markdown image exfiltration turns chat renderers into leak channels

At a glance

What this is: Archestra explains how Markdown image exfiltration turns AI chat rendering into a data leak path by letting untrusted content force the browser to fetch attacker-controlled URLs containing secrets.

Why it matters: IAM and NHI teams need to treat chat renderers, not just models, as part of the trust boundary because secrets in context can be exfiltrated without tool use, approval, or obvious user action.

Context

Markdown rendering is a presentation feature, but in AI chat products it becomes part of the security boundary the moment the browser is allowed to fetch URLs from model output. That matters because the leak path is outside the model, so prompt rules, tool allow-lists, and SSO do not stop it.

This is a classic data-exfiltration problem with an identity angle: the secret in the context window may be an API key, bearer token, or other non-human credential, and the browser can be tricked into sending it to an attacker-controlled endpoint. Treat data exfiltration as a render-path issue as much as a model issue.

Key questions

Q: What breaks when AI chat products render Markdown without a URL proxy?

A: The renderer becomes an exfiltration channel. If the browser can fetch model-generated image URLs directly, attacker-controlled content can move secrets out of the chat context without tool calls, user clicks, or obvious alarms. The failure is architectural, not conversational, so blocking bad prompts alone does not solve it.

Q: Why do secrets in an AI context window become more dangerous when Markdown is enabled?

A: Because the model can turn a secret into a link or image URL, and the browser will often resolve that URL automatically. That means an API key, token, or confidential snippet can leave the product boundary during rendering even when the model never executes a tool. The risk is outbound transmission, not model reasoning.

Q: How should teams stop browser-based exfiltration from AI chat outputs?

A: Put image retrieval behind a server-side proxy, allow only approved domains, and strip query strings and fragments before any fetch occurs. That removes the browser as a direct network client for model output and closes the channel the attacker depends on.

Q: What is the difference between model guardrails and runtime AI security controls?

A: Model guardrails are built into the model or provider layer and usually reflect known abuse patterns. Runtime AI security controls sit in the application path and can inspect, mask, block, or reroute risky interactions in real time. For production systems, runtime controls are the layer that reduces blast radius when the model is already in use.

Technical breakdown

How markdown image rendering becomes the exfiltration path

The attack works because Markdown is not just text once a chat UI renders it. An attacker supplies content containing an image tag, the model reproduces or preserves that content, and the browser resolves the URL on the user's behalf. If the URL includes a secret in the query string, path, or fragment, that secret is sent outside the product boundary during the render step. The model never needs a tool call, and the user never needs to click anything. This is why output filtering inside the model is unreliable: the renderer, not the model, performs the sensitive action. See the Prompt Injection Guide. See the Prompt Injection Guide.

Practical implication: Move the security control into the renderer path, not the model, and prevent direct browser fetches of model-generated URLs.

Why context-window secrets are exposed even when the model is well governed

The weak point is the mismatch between what the model can see and what the UI can send. If the assistant can access a confidential document, ticket, or token during generation, an attacker can shape the output so that the secret is embedded in a URL. The browser then performs an HTTP request that leaks the value to an external server. This bypasses common AI controls because the exfiltration does not depend on tool execution, policy prompts, or agent permissions. It depends on the chat surface trusting rendered markup. That is why context-window secrecy alone is not a sufficient control boundary for AI products. See the Data Exfiltration Guide. See the Data Exfiltration Guide.

Practical implication: Assume any secret present in model context can be turned into an outbound request unless the UI strips or blocks the render path.

Why image proxies and domain allow-lists close the channel

A safe design moves image retrieval away from the browser and into a server-side proxy under product control. The proxy can block unknown domains, remove query strings and fragments, and serve only approved bytes back to the client. That breaks the attack because attacker-controlled infrastructure never receives the secret-bearing request. This is an architectural control, not a content filter. Once the browser is no longer the component fetching the URL, the render step stops being an exfiltration channel. For AI products that support Markdown, this is the difference between cosmetic formatting and a security boundary. See the Data Security Guide. See the Data Security Guide.

Practical implication: Proxy every rendered image, strip sensitive URL components, and fetch only from a tightly controlled allow-list.

Threat narrative

Attacker objective: The attacker wants the victim's browser to send secrets from the AI chat context window to an external server without triggering obvious user action or model-side alarms.

1. Entry occurs when untrusted content is placed into the model's context window, such as a wiki page, support ticket, email body, or Jira comment containing a malicious Markdown image tag.
2. Credential harvesting happens when the model reproduces a secret-bearing placeholder or secret value inside the generated URL, exposing an API key, bearer token, or similar credential in the output.
3. Exfiltration occurs when the chat client renders the Markdown and the browser makes an outbound HTTP request to the attacker-controlled server, which records the secret from the request path or query string.

Breaches seen in the wild

• Hugging Face Spaces breach 2024: Unauthorised access to Hugging Face Spaces may have exposed secrets users stored for AI apps; tokens were revoked and org tokens removed.
• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Markdown image exfiltration is a renderer problem, not an LLM problem. The attack succeeds because the browser is the component that makes the outbound request, so model-side instructions, safety prompts, and tool restrictions are all in the wrong layer. That means AI governance needs to cover the full interaction path, including how the UI handles Markdown, URLs, and embedded media. Practitioners should treat the chat renderer as a security control surface, not a cosmetic detail.

This is a non-human credential exposure pattern disguised as a UI feature. The secret being leaked is often an API key, bearer token, or other machine credential that should never leave the trusted boundary in plain text. That makes the issue directly relevant to NHI governance, because the failure mode is credential disclosure through a presentation channel rather than through explicit tool abuse. Teams should map rendered-output leakage to credential handling and access scope, not only to prompt safety.

Proxying untrusted content is the right control boundary for AI chat products. If the product allows the browser to fetch model-generated URLs directly, the system has effectively delegated outbound communication to untrusted content. Prompt Injection Guide covers the broader class of attacks, but this specific pattern shows why render-time enforcement matters more than model-time advice. Security teams should design for containment at the transport layer, not rely on the model to self-censor.

Shadow AI risk now includes shadow rendering paths. A chat feature can look harmless while silently creating an exfiltration channel whenever Markdown is enabled without URL controls. That widens the governance question beyond model access and into product design review, where teams should inspect every place untrusted text can become a network request. The practical conclusion is simple: if the renderer can send it, the attacker can probably steer it.

Read next: Data Exfiltration Guide

What this signals

Render-path security is becoming a core AI governance issue. As more products let assistants format output richly, the security boundary shifts from the model prompt to the client renderer and its network behavior. Teams should assume any feature that converts untrusted text into a fetchable resource can become an exfiltration path unless it is mediated by policy at the transport layer.

Markdown exfiltration is the clearest example of why identity controls alone are insufficient. SSO, audit logs, and tool permissions do not stop a browser from sending a secret if the output layer is free to generate network requests. The control question for practitioners is no longer just who can access the model, but which parts of the UI are allowed to emit traffic on behalf of untrusted content.

For practitioners

• Proxy all rendered images Send every image URL through a server-side proxy under product control, not directly from the browser, so the user agent never fetches attacker-controlled links.
• Strip query strings and fragments Remove query parameters and fragments before fetching or serving images, because the attack relies on carrying secrets in the URL itself.
• Enforce a tight image allow-list Permit only the product CDN and a small set of approved content hosts, and block all other domains from image retrieval.
• Quarantine untrusted input before it reaches the main agent Keep suspicious documents, comments, and attachments in a constrained preprocessing path so they cannot influence the main model's outputs with secret-bearing markup.

Key takeaways

• Markdown image exfiltration turns a chat UI feature into a covert outbound channel when rendered content can trigger browser requests.
• The leak path bypasses model-side guardrails because the browser, not the model, performs the network action.
• The practical fix is architectural: proxy images, restrict domains, and remove secret-bearing URL components before render time.

Related NHI Mgmt Group resources: Prompt Injection Guide · Data Exfiltration Guide · Data Security Guide

Key terms

• Markdown Image Exfiltration: Markdown image exfiltration is a data theft technique that abuses markdown image syntax to trigger remote requests carrying sensitive information. Attackers use it to leak prompts, tokens, or file contents through rendered content. Defenders disable untrusted remote rendering, strip external image links, and inspect markdown before display.
• Render-path security: The set of controls that govern what a user interface can fetch, display, or transmit when it renders untrusted content. In AI chat products, this includes image proxies, domain allow-lists, URL sanitisation, and any policy that prevents the UI from becoming an unintended exfiltration channel.
• Context-Window Secret Leakage: Context-window secret leakage is the failure mode where a credential enters the AI model's working context and becomes visible to prompts, logs, or generated output. The issue is not storage alone. It is the loss of control over how the secret moves once the agent can reason over it.
• Image proxy: A server-side service that retrieves media on behalf of the client and returns only approved bytes to the user interface. Used correctly, it blocks direct browser requests to untrusted domains, strips dangerous URL components, and removes the network side effects that make Markdown image exfiltration possible.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the operational paths where secrets actually leak.