Disclosed vulnerability
Anthropic Claude data exfiltration via automatic markdown image rendering
AIR-2023-0018 AIR record · 2023-08-anthropic-claude-image-exfil
From the supporting source
Within two weeks Anthropic implemented a fix.embracethered.com
The record
Disclosed
2023-08-01
Vendor
Anthropic
Product
Claude
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — Claude auto-rendered the markdown image, sending data out
Attack surface
Consumer assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection document
Impact type
Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Claude users uploading untrusted files
Capability abused
Defense & remediation
Recorded defense
none
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
fixed within two weeks - reported 2023-07-12, validated 2023-07-18, closed 2023-07-26; Claude now requires a Show Image click
Taxonomy & references
Curator notes
Johann Rehberger.
Supporting sources
Cite as
Enkrypt AI. "Anthropic Claude data exfiltration via automatic markdown image rendering". AIR, AIR-2023-0018. https://agentincident.vercel.app/i/AIR-2023-0018/ (accessed 2026-10-19).