Markdown image exfiltration: are your chat UI controls enough?

TL;DR: Markdown image exfiltration lets attacker-controlled content smuggle secrets from an AI chat context window through a rendered image URL, bypassing model-side guardrails because the browser makes the outbound request, according to Archestra. The control point is the chat client: proxy images, strip query strings, and block untrusted domains before the render path becomes an exfiltration channel.

Editorial analysis by NHI Mgmt Group, based on content published by Archestra: “Data exfiltration via Markdown image tags”.

Key questions

Q: What breaks when AI chat products render Markdown without a URL proxy?

A: The renderer becomes an exfiltration channel.

Q: Why do secrets in an AI context window become more dangerous when Markdown is enabled?

A: Because the model can turn a secret into a link or image URL, and the browser will often resolve that URL automatically.

Q: How should teams stop browser-based exfiltration from AI chat outputs?

A: Put image retrieval behind a server-side proxy, allow only approved domains, and strip query strings and fragments before any fetch occurs.

Practitioner guidance

• Proxy all rendered images Send every image URL through a server-side proxy under product control, not directly from the browser, so the user agent never fetches attacker-controlled links.
• Strip query strings and fragments Remove query parameters and fragments before fetching or serving images, because the attack relies on carrying secrets in the URL itself.
• Enforce a tight image allow-list Permit only the product CDN and a small set of approved content hosts, and block all other domains from image retrieval.

Bottom line: Markdown image exfiltration turns a chat UI feature into a covert outbound channel when rendered content can trigger browser requests.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →