Research demo
ChatGPT plugin conversation exfiltration via markdown image rendering and cross-plugin request forgery
AIR-2023-0008 AIR record · 2023-05-openai-webpilot-markdown-exfil
From the supporting source
The individual controlling the data a plugin retrieves can exfiltrate chat history due to ChatGPT’s rendering of markdown images.embracethered.com
The record
Disclosed
2023-05-01
Vendor
OpenAI
Product
OpenAI ChatGPT (WebPilot / Expedia plugins)
Risk domain
Privacy › Data exfiltration channels
Also touches
Unsafe actuation, Confused deputy
System type
Generative model
Who acted
Agent acted — the assistant rendered the markdown image, fetching the attacker URL itself
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection web page
Impact type
Data exfiltration, Unauthorized tool invocation, Unauthorized transaction
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
ChatGPT plugin users who retrieved attacker-controlled pages
Capability abused
Defense & remediation
Recorded defense
none
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
not fixed - OpenAI told the researcher image markdown injection is a feature with no planned mitigation; notified 2023-04-09
Taxonomy & references
Curator notes
Johann Rehberger (Embrace The Red). Coined 'Cross Plugin Request Forgery'. Roman Samoilenko independently found the markdown-image exfil channel earlier. | Merged from duplicate id `2023-05-openai-chatgpt-plugin-markdown-exfil`. Also reported as: 'ChatGPT plugins: data exfiltration via images and cross plugin request forgery (WebPilot)'.
Supporting sources
Cite as
Enkrypt AI. "ChatGPT plugin conversation exfiltration via markdown image rendering and cross-plugin request forgery". AIR, AIR-2023-0008. https://agentincident.vercel.app/i/AIR-2023-0008/ (accessed 2026-10-19).