LLMs, GenAI, RAG, agents, evaluation · insight-0648
Close exfiltration channels such as auto-loaded links and images in model output
- Evidence type
- practitioner heuristic
- Difficulty
- hard
- Roles
- Applied AI, ML engineer
- Industries
- saas, healthcare
Summary: situation, action, reason, boundary
Situation
The chat interface renders model output as Markdown, including images and links to arbitrary domains, and the model can see private data.
Action
Do not auto-load remote resources from model output; allow-list domains for links and images; strip or neutralise URLs containing data from the conversation; log blocked attempts.
Reason
Greshake and colleagues list data theft among indirect-injection outcomes, and OWASP covers sensitive information disclosure; any outbound channel the model controls can carry stolen data.
Boundary
Chat interfaces, email drafting, agents with web or messaging tools.
Symptom or risk
An injected instruction makes the model emit an image URL with private data in its query string; the browser loads it and leaks the data without a click.
Exceptions
Plain-text interfaces that never render or fetch URLs.
Trade-offs
Users lose convenient inline links to unlisted sites.
Pitfalls
Securing the chat UI while an email or webhook tool remains an unrestricted outbound path.
Lessons and concepts
Claims and their sources
Indirect prompt injection threats demonstrated by Greshake and colleagues include data theft from users of LLM-integrated applications.
OWASP lists LLM02 Sensitive Information Disclosure among the 2025 risks.