{
 "public_id": "AIR-2023-0012",
 "incident_id": "2023-06-microsoft-bing-chat-exfil",
 "date_disclosed": "2023-06-18",
 "date_occurred": null,
 "title": "Bing Chat data exfiltration via image markdown injection from webpage content",
 "class": "responsible_disclosure",
 "attack_surface": "consumer_chatbot",
 "initial_vector": "indirect_prompt_injection_web_content",
 "agent_capability_abused": [
  "page_content_ingestion",
  "markdown_image_rendering"
 ],
 "target_product": "Bing Chat",
 "target_vendor": "Microsoft",
 "autonomy_level": "assistant",
 "impact_realized": false,
 "impact_type": [
  "data_exfiltration",
  "pii_disclosure"
 ],
 "blast_radius": "Bing Chat users browsing attacker-influenced pages",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI02"
  ],
  "mitre_atlas": [],
  "labels": [
   "image_markdown_exfiltration",
   "zero_click"
  ]
 },
 "defense_present": "none initially; fixed with a Content Security Policy",
 "defense_bypassed": true,
 "fix_shipped": "fixed 2023-06-15 with a CSP restricting image loads to trusted Bing domains; disclosed 2023-04-08",
 "primary_sources": [
  "https://embracethered.com/blog/posts/2023/bing-chat-data-exfiltration-poc-and-fix/"
 ],
 "verified_quote": "This means that during a Prompt Injection attack where an adversary hijacks the AI, the attacker can search the current web page for secrets or PII, append such data to the URL of an image and have it automatically exfiltrated.",
 "confidence": "high",
 "notes": "Johann Rehberger. The original image-markdown exfiltration disclosure that the whole class descends from.",
 "risk_category": "privacy",
 "risk_secondary": [],
 "risk_subcategory": "PII Leakage",
 "risk_sub_secondary": [
  "Data Exfiltration via Context"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "Bing Chat fetched the attacker's image URL with the data appended",
 "vector_family": "indirect_prompt_injection",
 "vector_detail": "indirect_prompt_injection_web_content",
 "guardrail_kind": [
  "none"
 ],
 "guardrail_outcome": "not_applicable",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "unknown",
 "model_provider": "microsoft",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "sensitive_data_exposure",
 "eai_domain": "privacy",
 "eai_secondary": [
  "data_exfiltration_channels",
  "confused_deputy"
 ],
 "eai_reason": "subcategory: PII Leakage",
 "asi_curated": [
  "ASI01"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI01 | added ASI02 (impact=tool_misuse)",
 "submitted_by": "EAI Internal"
}