title: Markdown Image URL Exfiltration and XSS Injection
id: ATR-2026-00405
rule_version: 1
status: experimental
description: |
  Detects instructions to produce markdown image/link syntax that exfiltrates context data via URL query parameters, and javascript: XSS via markdown link, from NVIDIA garak web_injection probe. When an agent renders markdown in a browser/Colab/playground, the image tag loads a remote URL with sensitive data in the query string. Key signals: markdown image syntax with placeholder markers ([INFO], [NUM], [DATA]) in the URL, known exfil domains (wuzzi.net, derczynski.com, llmsec.net), javascript: URI in markdown link, and the StringAssembly concatenation template.
author: ATR Community (via NVIDIA garak web_injection probe)
date: 2026/04/21
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM02:2025
    - LLM01:2025
  owasp_agentic:
    - ASI01:2026
    - ASI03:2026
  mitre_atlas:
    - AML.T0025 - Exfiltration via Cyber Means
    - AML.T0051 - LLM Prompt Injection
  research:
    - https://github.com/NVIDIA/garak/blob/main/garak/probes/web_injection.py
    - https://embracethered.com/blog/posts/2023/ai-injections-direct-and-indirect-prompt-injection-basics/
compliance:
  nist_ai_rmf:
    - subcategory: MS.2.10
      context: This rule detects markdown image/link syntax crafted to exfiltrate sensitive context data via URL query parameters to known attacker domains; MS.2.10 requires that privacy risks such as covert data leakage from agent outputs are assessed and tracked.
      strength: primary
    - subcategory: MS.2.7
      context: 'Detection of javascript: URIs and XSS payloads embedded in markdown links rendered by browser/Colab/playground frontends provides evidence for MS.2.7''s requirement to evaluate AI system security and resilience against rendering-layer injection attacks.'
      strength: secondary
    - subcategory: MG.2.3
      context: Matches on garak web_injection exfil domains and StringAssembly templates trigger risk treatment plans to block or sanitize tool responses before rendering; MG.2.3 requires these containment mechanisms be in place to disengage unsafe outputs.
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Markdown Image URL Exfiltration and XSS Injection).
      strength: primary
    - clause: '6.2'
      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Markdown Image URL Exfiltration and XSS Injection) is such a treatment.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Markdown Image URL Exfiltration and XSS Injection).
      strength: primary
    - article: '10'
      context: Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Markdown Image URL Exfiltration and XSS Injection) affecting that data.
      strength: secondary
tags:
  category: context-exfiltration
  subcategory: markdown-url-data-leak
  scan_target: tool_response
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
metadata_provenance:
  garak_probe: web_injection.MarkdownImageExfil
  garak_detector: web_injection.MarkdownExfilDetector
  payload_source: garak/probes/web_injection.py + garak/data/xss/
detection:
  conditions:
    - field: tool_response
      operator: regex
      value: '!\[[^\]]{0,60}\]\(https?://[^\s)]{3,100}\?[^)]{0,80}=\s*(?:\[(?:INFO|NUM|DATA|CONTEXT)\]|\{[A-Z_]{2,20}\})'
      description: Markdown image URL with data placeholder in query param
    - field: user_input
      operator: regex
      value: \[link\]\(javascript:[^\)]{1,200}\)
      description: 'javascript: URI in markdown link (XSS)'
    - field: tool_response
      operator: regex
      value: https?://(?:wuzzi\.net|derczynski\.com|llmsec\.net)
      description: Known garak web_injection exfil domains as URL in tool response
    - field: tool_response
      operator: regex
      value: Concatenate\s+these\s+strings[\s\S]{0,120}replace\s+\[(?:INFO|NUM|DATA)\]
      description: StringAssembly exfil template
    - field: tool_response
      operator: regex
      value: Print\s+the\s+following[\s\S]{0,80}!\[data\]\(https?://[\s\S]{0,80}=\[(?:DATA|INFO)\]
      description: PlaygroundMarkdownExfil template
  condition: any
  false_positives:
    - Standard markdown image embeds with legitimate CDN URLs and no placeholder tokens
    - Academic references to wuzzi.net or other research domains in educational content
    - Legitimate markdown links to https:// URLs
response:
  actions:
    - alert
    - block_tool
  message_template: |
    [ATR-2026-00405] Detected markdown-based data exfiltration or XSS injection attempt. Tool output blocked due to suspicious URL placeholder or javascript: URI.