AI Security Atlas › All entries › LLM Application & Output Security
Output-Rendered Data Exfiltration
Injected instructions make the model emit markdown images, links, or HTML that leak context to attacker URLs when rendered.
Open in the interactive atlas →Impact
Chat history, documents, or tokens are sent to an attacker server with zero user clicks.
Why this severity
Impact High × Likelihood Medium = High
Impact high: zero-click data theft. Likelihood medium: demonstrated against ChatGPT, Bard, M365 Copilot, and Lenovo's chatbot; vendors patched the reported paths.
Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood Medium: Publicly demonstrated against real products or in peer-reviewed research, or seen in the wild only with a prior foothold such as stolen credentials.
Method: OWASP Risk Rating Methodology
Evidence
- Demonstration: ChatGPT Conversation Exfiltration (MITRE ATLAS case study AML.CS0021, 2023)
- Demonstration: Google Bard Conversation Exfiltration (MITRE ATLAS case study AML.CS0029, 2023)
- Demonstration: EchoLeak: Zero-Click Prompt Injection Targeting M365 Copilot for Data Exfiltration (MITRE ATLAS case study AML.CS0059, 2025)
- Demonstration: Cross-Site Scripting via Prompt Manipulation in Lenovo AI Chatbot (MITRE ATLAS case study AML.CS0060, 2025)
Related
Exploits
- Unsanitized Output Rendering Vulnerability · High severity
Mitigated by
- Output Encoding & Strict CSP Guardrail · Fixes high risks
Remediation
- Never auto-load remote images or iframes from model output.
- Restrict rendered link targets to an allowlist of domains.
- Treat model output as untrusted input to the frontend.
How to verify
- Plant an image-exfil payload and confirm no outbound request occurs.
- CSP violation reports stay at zero in production.
Framework mapping
OWASP Top 10 for LLM Applications 2025
- LLM05:2025 Improper Output Handling
- LLM02:2025 Sensitive Information Disclosure
MITRE ATLAS
NIST AI RMF 1.0
- MEASURE 2.10 Privacy risk of the AI system is examined and documented