If your chat interface renders model output as Markdown or HTML, an injected instruction can make the model write an image link that carries your data in its address. When the browser loads the image, the data goes to the attacker. The fix is to control what output is allowed to render and where requests can go.
How the leak works
OWASP gives a concrete scenario. A user asks an LLM to summarise a web page. Hidden instructions on the page cause the model to insert an image linked to an attacker's URL, and the conversation is exfiltrated through that link.
Nobody clicks anything. Rendering the image is enough, because the browser fetches it automatically. The sensitive text rides along in the URL.
The OWASP cheat sheet lists HTML and Markdown injection as its own attack type: markup in responses that creates deceptive links or exfiltrates data through image tags.
Three places to close it
Treat the model as an untrusted user, which is OWASP's framing for output handling.
- Rendering. Do not render raw HTML from model output. If you render Markdown, decide whether images are allowed at all. If they are, restrict them to hosts you control.
- Network policy. Use a strict Content Security Policy so the page cannot load images or scripts from arbitrary origins. OWASP recommends strict CSP to limit XSS from generated content, and the same control narrows image exfiltration.
- Context-aware encoding. Encode output for where it lands, such as HTML encoding for web content.
Links need the same thought. A deceptive link whose visible text differs from its address is a phishing helper, and a model can be instructed to write one.
Reduce what there is to steal
Closing the channel is half the job. The other half is limiting what the conversation holds. Do not put credentials, tokens or internal data in the context unless the task needs them. Keep untrusted content separate and clearly marked so it has less influence.
Monitoring helps too. OWASP recommends logging and monitoring to detect unusual output patterns. Output containing long encoded strings inside URLs is a pattern worth alerting on.
A quick test
Ask your application to summarise a page you control that tells the model to include an image from a test server. Check your server logs. If a request arrives, the channel is open. Do this only against systems you own.
Safeguard's MCP Guardrail and policy features apply to tool and agent traffic, which is a separate surface from browser rendering, so treat your front end controls as your own job.
Quick check
Does the user have to click the image?
No. Browsers load images automatically when the content renders.
Is blocking images enough?
It closes this route. Links, scripts and tool calls are other routes, so keep the broader output controls too.
Sources
- OWASP GenAI: LLM01 Prompt Injection
- OWASP GenAI: LLM05 Improper Output Handling
- OWASP LLM Prompt Injection Prevention Cheat Sheet
Last reviewed: 19 October 2026.
