Disclosed vulnerability
Google Cloud Vertex AI Generative AI Studio: image markdown injection data exfiltration
AIR-2023-0025 AIR record · 2023-10-google-vertex-ai-studio-exfil
From the supporting source
This allows an attacker to exfiltrate the current chat conversation by instructing the LLM to append it to the `src` attribute which is the URL where the image is loaded from.embracethered.com
The record
Disclosed
2023-10-19
Vendor
Google
Product
Google Cloud Vertex AI - Generative AI Studio
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — Vertex AI Studio rendered the exfiltration image
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection document
Impact type
Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Vertex AI Generative AI Studio users
Capability abused
Defense & remediation
Recorded defense
none
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
fixed by 2023-10-19; reported 2023-08-30 and accepted within 22 minutes, VRP reward issued 2023-09-16
Taxonomy & references
Curator notes
Johann Rehberger.
Supporting sources
Cite as
Enkrypt AI. "Google Cloud Vertex AI Generative AI Studio: image markdown injection data exfiltration". AIR, AIR-2023-0025. https://agentincident.vercel.app/i/AIR-2023-0025/ (accessed 2026-10-19).