Disclosed vulnerability
Writer.com: hidden instructions on an added web source exfiltrate uploaded files and chat history via markdown image rendering
AIR-2023-0031 AIR record · 2023-12-writer-com-indirect-injection-exfil
From the supporting source
Attackers can prepare websites that, when a user adds them as a source, manipulate the LLM into sending private information to the attacker or perform other malicious activities.promptarmor.substack.com
The record
Disclosed
2023-12-15
Vendor
Writer
Product
Writer.com
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — Writer.com fetched the attacker image URL with the file contents
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection web content
Impact type
Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Writer.com enterprise users adding untrusted URLs as sources
Capability abused
Defense & remediation
Recorded defense
none
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
partial 2023-12-19: markdown image/link rendering disabled
Taxonomy & references
Curator notes
PromptArmor, one of the earliest public enterprise-assistant exfiltration disclosures. Disclosed 2023-11-29; Writer initially declined to treat it as a security issue; partial mitigation 2023-12-19. Leaked data in the demo included SSNs, revenue figures and salary information. Also mirrored at https://www.promptarmor.com/resources/data-exfiltration-from-writer-com-via-indirect-prompt-injection
Supporting sources
Cite as
Enkrypt AI. "Writer.com: hidden instructions on an added web source exfiltrate uploaded files and chat history via markdown image rendering". AIR, AIR-2023-0031. https://agentincident.vercel.app/i/AIR-2023-0031/ (accessed 2026-10-19).