Disclosed vulnerability
Bing Chat data exfiltration via image markdown injection from webpage content
AIR-2023-0012 AIR record · 2023-06-microsoft-bing-chat-exfil
From the supporting source
This means that during a Prompt Injection attack where an adversary hijacks the AI, the attacker can search the current web page for secrets or PII, append such data to the URL of an image and have it automatically exfiltrated.embracethered.com
The record
Disclosed
2023-06-18
Vendor
Microsoft
Product
Bing Chat
Risk domain
Privacy › Sensitive data exposure
Also touches
Data exfiltration channels, Confused deputy
System type
Generative model
Who acted
Agent acted — Bing Chat fetched the attacker's image URL with the data appended
Attack surface
Consumer assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection web content
Impact type
Data exfiltration, Pii disclosure
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI06 – Memory & Context Poisoning
- MITRE ATLAS
- AML.T0057 – LLM Data Leakage
- NIST AI RMF
- MEASURE 2.10
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Use data anonymization; Implement log sanitization to scrub PII.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Bing Chat users browsing attacker-influenced pages
Capability abused
Defense & remediation
Recorded defense
none initially; fixed with a Content Security Policy
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
fixed 2023-06-15 with a CSP restricting image loads to trusted Bing domains; disclosed 2023-04-08
Taxonomy & references
Curator notes
Johann Rehberger. The original image-markdown exfiltration disclosure that the whole class descends from.
Supporting sources
Cite as
Enkrypt AI. "Bing Chat data exfiltration via image markdown injection from webpage content". AIR, AIR-2023-0012. https://agentincident.vercel.app/i/AIR-2023-0012/ (accessed 2026-10-19).