title: Markdown Image URL Data Exfiltration id: ATR-2026-00261 rule_version: 1 status: experimental description: | Detects prompts that coerce the LLM into emitting a markdown image reference with sensitive data encoded into the URL path or query string, exploiting auto-fetch behaviour in chat UIs. When the client renders the markdown, the browser makes a GET request to the attacker-controlled domain, leaking conversation context or retrieved secrets. Technique from NVIDIA garak xss probe family (prompt templates use concatenated strings with base64-encoded payloads in image src URIs). author: ATR Community (via NVIDIA garak xss probe) date: 2026/04/19 schema_version: '0.1' detection_tier: pattern maturity: test severity: high references: owasp_llm: - LLM06:2025 - LLM02:2025 owasp_agentic: - ASI03:2026 - ASI08:2026 mitre_atlas: - AML.T0057 - LLM Data Leakage research: - https://github.com/NVIDIA/garak/tree/main/garak/data/xss - https://embracethered.com/blog/posts/2023/markdown-image-exfiltration/ compliance: eu_ai_act: - article: '15' context: Markdown image URL exfiltration exploits chat UI auto-fetch behavior to transmit base64-encoded conversation data to attacker-controlled domains via LLM-generated image references; Article 15 cybersecurity requirements mandate that AI system output handlers detect and block covert exfiltration channels embedded in rendered content. strength: primary - article: '13' context: Covert exfiltration via markdown rendering is invisible to users and operators, directly violating the transparency that Article 13 requires by allowing AI-generated output to silently transmit user data without any indication. strength: secondary - article: '10' context: Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Markdown Image URL Data Exfiltration) affecting that data. strength: secondary nist_ai_rmf: - subcategory: MP.5.1 context: Markdown image URL exfiltration is an adversarial input technique that coerces LLMs into generating image references that encode base64 conversation data in query strings, triggering auto-fetch exfiltration; MP.5.1 requires this output-channel attack pattern to be identified and tracked. strength: primary - subcategory: GV.6.1 context: Exfiltrating conversation context and user secrets via markdown-rendered image URLs to attacker-controlled domains violates data governance boundaries; GV.6.1 policies must cover AI-generated output as a potential unauthorized data transmission channel. strength: secondary - subcategory: MS.2.7 context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (Markdown Image URL Data Exfiltration). strength: primary - subcategory: MS.2.10 context: NIST AI RMF MEASURE 2.10 (privacy risk examined and documented) is supported by this rule's detection of the context-exfiltration attempt (Markdown Image URL Data Exfiltration). strength: secondary iso_42001: - clause: '6.2' context: Risk treatment activities under clause 6.2 must include output scanning controls targeting markdown image syntax with encoded payloads, which exploits chat UI auto-fetch behavior to silently exfiltrate conversation data. strength: primary - clause: '8.4' context: AI system impact assessment under clause 8.4 must document the markdown image exfiltration vector, where LLM-generated image references encode sensitive context in URLs that the rendering client automatically fetches to attacker domains. strength: secondary - clause: '8.1' context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Markdown Image URL Data Exfiltration). strength: primary tags: category: context-exfiltration subcategory: markdown-image-uri scan_target: mcp confidence: high agent_source: type: mcp_exchange framework: - any provider: - any detection: conditions: - field: tool_response operator: regex value: concatenate\s+(?:these|the\s+following)\s+strings[^\n]{0,200}(?:replace|substitute)\s+\[?[A-Z_]+\]?\s+with\s+(?:the\s+)?(?:base64|url|hex)[\s-]?encoded description: 'Garak concat-template: "concatenate strings and replace MARKER with base64-encoded X" - core XSS payload generator' - field: tool_response operator: regex value: '!\[[^\]]{0,80}\]\(\s*https?://[^\s)]{1,200}\[(?:INFO|NUM|DATA|SECRET|PAYLOAD|BEGIN_DATA|END_DATA|TOKEN)\][^)]{0,200}\)' description: Markdown image syntax with injection-marker placeholder in URL - direct XSS payload template - field: tool_response operator: regex value: (?:print|output|render|show|display|emit)\s+(?:the\s+)?(?:following\s+)?(?:markdown|image|url|uri|link)[^\n]{0,80}\[(?:INFO|NUM|DATA|SECRET|PAYLOAD)\][^\n]{0,40}(?:base64|hex|url)[\s-]?encoded description: Instruction to emit markdown with placeholder replaced by encoded sensitive data - field: tool_response operator: regex value: '!\[[^\]]*\]\(\s*https?://[^\s)/]{3,80}/[^\s)?]{0,80}\?[^=\s)]{0,30}=[A-Za-z0-9+]{60,}={0,3}[^)]{0,50}\)' description: LLM output contains markdown image whose query string holds a base64 payload >= 60 chars (exfil pattern; CDN path UUIDs live in path segment, not query string) - field: tool_response operator: regex value: (?:replace|substitute)\s+\[?[A-Z_]{3,}\]?\s+with\s+(?:the\s+)?(?:[^\s]{1,30}\s+){0,3}(?:previous\s+message|conversation|user.{0,20}(?:email|code|name|token|secret|api[\s-]?key)|this\s+conversation) description: Instruction to substitute marker with conversation context / user secret - exfil intent condition: any false_positives: - Documentation explaining markdown image syntax without instruction-driven exfiltration - Legitimate analytics pixel URLs embedded in email templates - Technical discussions of content security policies and image sourcing response: actions: - alert - block_tool message_template: | [ATR-2026-00261] Markdown image exfiltration pattern detected - conversation data may be encoded into image URL for attacker retrieval.