Data Exfiltration Channels in LLM Applications

TL;DR: Exfiltration is the last link of most prompt injection attacks: the model has private data in context and an instruction to send it somewhere. The channels include tools that send messages or make requests, URLs that carry data in their path or query string, markdown images that the client fetches automatically, links users are persuaded to click, link previews, and writes to places the attacker can read. Rendering and egress controls close these channels deterministically, which is why they are often the cheapest strong defence.

Why channels matter more than injections

You cannot reliably stop a model from being instructed to leak. You can make leaking impossible. If every path out of the system goes only to destinations the attacker cannot read, an injected model holding private data has nowhere to send it. This is the "external communication" leg of the lethal trifecta, and it is often the easiest leg to remove or restrict.

The channels

Explicit tools. Email, chat messages, HTTP requests, webhooks, ticket comments, file uploads. Obvious, and usually what teams think of first.

URLs as carriers. Any request can carry data in its path, query string or headers. A "fetch this page" tool is an outbound channel, because the model chooses the URL.

Markdown and HTML rendering. An image tag makes the client request the image URL as soon as the message renders. Reference-style markdown, HTML in responses, CSS backgrounds and other auto-loaded resources are variants. Public research has demonstrated this against many production assistants since 2023.

Links. A link with data in its URL needs a click, which a well-crafted message can obtain ("click here to verify your account").

Previews and unfurling. Chat platforms and email clients often fetch URLs to build previews, turning a link into an automatic request.

Writes the attacker can read. Public pull requests, public comments, shared documents, calendar invites to external addresses, DNS lookups from code execution.

Controls

Two cautions. An allowlisted domain that redirects or proxies to arbitrary URLs makes the allowlist meaningless; audit allowed origins. And markdown has more than one way to embed an image; sanitise the rendered HTML, not just one markdown syntax.

How vendors closed the URL channel, and what is left

URL-based exfiltration has a published engineering history worth knowing:

• Domain allowlists were not enough. OpenAI's write-up on preventing URL-based exfiltration in agents describes starting with a hand-curated list of allowed domains. It covered only about 10% of the URLs users actually visited, so users were pushed through warnings constantly, and open redirects on allowed domains bypassed it anyway.
• An index-based allowlist replaced it. OpenAI moved to allowing only URLs its search crawler had already seen independently, which therefore cannot contain a particular user's data, with canonicalisation of URLs before comparison; URLs the user typed or that came back from search are also treated as safe. Expected coverage rose above 80% of visited URLs. The guarantee is deliberately narrow: loading such a resource cannot carry user data out; it says nothing about whether the content is safe.
• No arbitrary URL construction. OpenAI's deep research system card (February 2025) states that the agent may not navigate to or construct arbitrary URLs, which stops it putting an API key into URL parameters, and reports injection evaluations falling from about 4% to 0% after mitigation.
• Deterministic blocking. Microsoft's security response team wrote in July 2025 that it deterministically blocks the impact of known exfiltration methods, including Markdown image injection and certain untrusted links, and that Outlook's Copilot requires the user to send drafted mail themselves.
• Turning rendering off. After CamoLeak, GitHub disabled image rendering in Copilot Chat.

What remains is slow and noisy. With an index-based allowlist, an attacker needs per-character URLs that were already crawled, so leaking even a street address takes a dozen sequential requests to one domain, which shows up in logs as a burst.

Worked example: exfiltration bandwidth per channel

Each control converts "one silent request" into "many correlated requests" or none. Pair it with a cap on outbound fetches per response and alerts on bursts.

A channel that needs no injection

Weiss and colleagues (2024) showed that streamed responses leak information to a network observer even over TLS: because many assistants sent one token per encrypted packet, packet sizes revealed token lengths, and from those the researchers reconstructed 29% of responses accurately and inferred the topic of 55%. The fix is padding or batching tokens before sending. It is a reminder that "exfiltration" includes side channels an attacker on the user's network can read without touching the model.

Misconceptions interviewers listen for

• "A text-only assistant cannot leak data." Rendered Markdown images and links are network requests.
• "Our CSP's img-src fixes it." First-party proxies and redirectors on the allowlist carry data onward.
• "Domain allowlists are enough." Open redirects defeat them, and low coverage trains users to click through warnings.
• "Block the injection and the leak is solved." Detection misses; block the channel.

How this shows up in interviews

"How can an assistant that only outputs text still leak data?" is a favourite, because many candidates think only of tools. Name the rendering channel first, then the others, and propose deterministic controls in the client and at the network edge. Connect it to detection: log outbound URLs from assistant responses and alert on high-entropy query strings or first-seen domains.

Say it in 30 seconds: "An injected model still needs a way out, and LLM apps have many: send and HTTP tools, URLs that carry data, markdown images that clients load automatically, links and previews, and public writes. I close them deterministically: egress allowlists through a proxy, a renderer that only loads images from allowed origins with a strict CSP, no auto-unfurling, and policies on public writes. That works however the injection was phrased."