An instruction needs an exit

How prompt injection exfiltrates data through AI assistants

An injected instruction that says “send the private data outward” achieves nothing unless the assistant has a way to send it. The history of prompt injection is largely a history of exits: rendered images, links, tool calls and messages that carried data out of a conversation. Knowing those exits is the most practical thing a user or a builder can learn, because closing them is what turns an injection from a breach into an annoyance.

Published 5 September 2026
By the Prompt Injection Scanner editorial team (Mothership Engineering)
Every claim traces to the primary references listed at the foot of the page

Why the exit matters more than the instruction

Simon Willison’s “lethal trifecta” names three capabilities that together make data theft possible in an AI system: access to private data, exposure to untrusted content, and a way to communicate externally. The third is the one people forget. A chat assistant that can only print text to the person reading it has no exit; whatever an injected instruction asks, the data stays on the screen. The moment the assistant can fetch a URL, render an image, send a message or call a tool, the same instruction has somewhere to go.

Every documented exfiltration has used one of a small number of exits, and each vendor fix has closed a specific one. Reading them in order shows how little the instruction side has changed and how much of the defensive work has been spent on the channel.

Markdown images: the original exit

Most chat interfaces render Markdown, and Markdown can embed an image by URL. In April 2023 Johann Rehberger showed that an instruction planted in content Bing Chat was reading could make the assistant emit an image tag whose URL pointed at an attacker’s server and carried the conversation’s contents in the query string. The client rendered the image, the browser requested the URL, and the data arrived at the attacker without a click. He reported it on 8 April 2023; Microsoft fixed it on 15 June by adding a content security policy that only allowed images from a short list of its own domains.

The same trick reappeared in product after product over the following two years, because every new assistant that rendered Markdown reopened it. It is the reason vendors now treat image rendering as a security surface: Google’s June 2025 description of Gemini’s defences includes identifying external image URLs and declining to render them, alongside checking links against Safe Browsing.

Reference-style links and trusted domains: EchoLeak

EchoLeak, disclosed by Aim Labs in June 2025 and tracked as CVE-2025-32711, is the most complete example of the pattern in an enterprise product. A single email sent to a Microsoft 365 Copilot user contained instructions phrased as guidance to a human reader, which let it pass the classifier meant to catch injection. When the user later asked Copilot an ordinary business question, retrieval judged the email relevant and handed it to the model. The instructions told the model to gather internal data and place it in a Markdown image, and the image URL used Microsoft’s own Teams and SharePoint domains, which the content security policy trusted, to relay the request onward. No user action was required beyond receiving the email and using Copilot normally.

Aim Labs reported the chain in January 2025; Microsoft fixed it server-side in May and said no customers had been affected. The lesson is not about one product. Allowlisting your own domains is a sensible fix for the 2023 exit, and EchoLeak showed that a trusted domain with an open redirect or a proxying endpoint is still an exit.

A link the user clicks: Slack AI

Not every exit is automatic. In August 2024 PromptArmor described an attack on Slack AI in which the attacker created a public channel containing only themselves and posted instructions there. When a user asked Slack AI for an API key they had stored in a private message, retrieval pulled both the private message and the attacker’s instructions into the same context. The assistant followed the instructions, rendering a link labelled as a re-authentication prompt with the key appended as a parameter. The exit was the user’s own click.

Slack’s initial response was that messages in public channels are visible to every workspace member by design, which is true and beside the point. The channel was not the vulnerability; the assembly of a stranger’s text and a user’s secret into one answer was. That is the retrieval half of the trifecta, and it is why segregating external content from private data is listed among OWASP’s core mitigations.

Tool calls and messages: agents carry their own data out

Agents do not need a rendering trick, because they have legitimate tools that send things. In Invariant Labs’ May 2025 GitHub MCP demonstration, the agent followed instructions in a public issue, read private repositories and then published what it had read through its own ordinary ability to open a pull request. In Brave’s August 2025 analysis of the Comet browser, the agent fetched a one-time login code from the user’s email and posted it, together with the user’s address, to a public forum. Nothing was smuggled; the agent simply used the capabilities it had been given, on behalf of the wrong party.

This is why confirmation steps matter more for agents than classifiers do. Google’s user-confirmation framework, OpenAI’s advice to require approval before an agent sends a message or makes a payment, and Brave’s recommendation that security-sensitive tasks need explicit user confirmation are all attempts to put a person between the instruction and the exit.

What the fixes have in common, and what to check yourself

Three controls recur. Restrict where rendered content can load from, and assume any trusted domain with a redirect is a hole. Strip or redact external URLs from model output before rendering it, rather than trusting the model to omit them. Require a person to confirm anything that sends, posts, pays or publishes. None of these depends on recognising the injected text, which is what makes them durable.

For someone reviewing text before it reaches an assistant, the scanner on this site inspects link destinations separately from their labels, reads HTML and Markdown without rendering either, and reports instruction patterns that direct content outward, with the exact span and channel. It cannot see what your assistant will render or which tools it holds. So treat any link or image an assistant produces after reading untrusted content with suspicion, read the query string before you click, and prefer assistants that show you where a link goes. A clean scan does not close an exit; only the controls above do.

Primary references

These sources describe the external risks or standards discussed above. The property’s detector claims remain limited to its versioned policy and recorded evidence.

Browse every guide

Result boundary: Findings are indicators for review. Detection cannot certify a source, and a no-indicator result does not replace downstream isolation, validation, least privilege or approval.

Start a private scan Review limitations