# Data Exfiltration via Image Rendering Fixed in Amp Code

Prompt injection in Amp Code tricked the AI agent into rendering markdown images with chat data as query params, exfiltrating .env secrets to an attacker server.

- Payout: Research
- Severity: medium
- Program: Amp Code
- Write-up by: Johann Rehberger
- Disclosed: 2025-08-17
- Write-up quality: 6/10
- Original: https://embracethered.com/blog/posts/2025/amp-code-fixed-data-exfiltration-via-images/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amp-code-fixed-data-exfiltration-via-images
- Tags: area:ai domain:ai impact:data-leak impact:pii-leak kind:research platform:research sev:medium tech:llm technique:chained vuln:prompt-injection

**Target:** AI coding agent markdown image rendering
**Root cause:** The agent auto-renders markdown images from untrusted content (source code comments, tool output) without restricting outbound requests, letting injected instructions embed context data in image URLs.
**Steps:**
1. Host a webpage containing prompt injection instructing the agent to 'backup' chat data via a markdown image with data as query param
2. Have Amp visit/analyze the page or a source file containing the injection in a comment
3. Injection uses a grep-tool invocation trick to bypass model refusals and pull .env contents into context
4. Agent renders markdown image pointing to attacker server with exfiltrated data in the URL
**How found:** Reused a pre-existing Copilot-style PoC demo and observed it worked against Amp; noted model refusals when reading/leaking secrets and worked around via cryptic grep tool invocation.
**Exploitation:** Attacker plants prompt injection in a source file comment or web page; when Amp analyzes it, the agent reads sensitive files (e.g. .env) into context and renders an image whose URL carries the data to an attacker-controlled server, 0-click.
**Escalation:** Chains file-read tool to pull secrets into context before exfiltration; grep invocation trick bypasses model refusal.
**Insight:** When testing AI agents, check whether markdown image/link rendering triggers outbound requests and whether injected instructions can smuggle context into URL query params; also probe model refusals and find alternate tool invocations (e.g. grep) to bypass them.