Researcher shows inbox data theft via markdown image in AI chat

A write-up describes a prompt-injection attack where a hidden instruction in an email makes an AI assistant end its summary with a markdown image whose URL carries the last five subject lines. The browser fetches the image automatically, leaking data to the attacker's server without a click. Suggested fixes include domain allowlists, image proxying and a strict CSP.

• Hidden email instruction makes the model embed data in an image URL
• Browser auto-loads the image, leaking data to an attacker's access log
• Fixes include domain allowlists, proxying and a strict image CSP
• Testers should watch the network tab, not the model's answer