# Link unfurling leaks chat context

Model output rendered as live links or images that a client or bot auto-fetches, carrying conversation data

_Area: AI and LLM app security. Seen in 2 disclosed reports; latest 2025-06-24. Updated 2026-10-23._

## How it works
An LLM app renders model output as clickable links or images. The chat platform or client then automatically fetches those URLs to build previews (link unfurling, media preview). If attacker-influenced content (prompt injection, ingested documents) makes the model emit a URL that embeds prior chat context, the auto-fetch sends that context to an attacker-controlled server. The broken assumption: rendering a link is treated as inert display, when in fact the client makes an outbound request that carries whatever is in the URL.

## Where it shows up
- Agent or bot tools that post messages to Slack/Teams/Discord without setting `unfurl_links`/`unfurl_media` to false [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-security-advisory-anthropic-slack-mcp-server-data-leakage.md).
- Model output rendered as markdown links or images built from untrusted context [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-aws-amazon-q-fixes-markdown-rendering-vulnerability.md).
- Any agent-writable channel where URLs are crawled by the platform [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-security-advisory-anthropic-slack-mcp-server-data-leakage.md)[E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-the-dangers-of-unfurling-and-what-you-can-do-about-it.md).
- Server logs showing the platform's crawler user-agent hitting attacker URLs [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-the-dangers-of-unfurling-and-what-you-can-do-about-it.md).

## How to review
Check the exact property: no URL derived from model output or conversation data is ever auto-fetched by a client or platform. Concretely: confirm unfurl/preview is disabled on every message-send path an agent can reach [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-security-advisory-anthropic-slack-mcp-server-data-leakage.md); confirm untrusted ingested content cannot cause the model to emit links/images whose URLs embed prior context [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-aws-amazon-q-fixes-markdown-rendering-vulnerability.md); confirm the rendering layer treats model-emitted URLs as untrusted. To verify, inspect outbound requests (crawler user-agent) and test whether injected content can shape a URL containing chat data [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-the-dangers-of-unfurling-and-what-you-can-do-about-it.md).

## Variants seen
- MCP server posting to Slack with unfurling left on, exfiltrating private data via crafted hyperlinks [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-security-advisory-anthropic-slack-mcp-server-data-leakage.md).
- LLM Slack bot rendering a link with prior chat data appended, leaked by default unfurling [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-the-dangers-of-unfurling-and-what-you-can-do-about-it.md).
- Amazon Q rendering attacker markdown links embedding chat history, exfiltrated on a phishing click [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-aws-amazon-q-fixes-markdown-rendering-vulnerability.md).

## Impact and severity
Private conversation data and chat history leaked to third-party servers. Severity is high because the exfil channel is a default platform behavior, not a bug the app controls, and it needs no code execution. It worsens when agents can write to shared channels and when unfurling is on by default across platforms [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-security-advisory-anthropic-slack-mcp-server-data-leakage.md)[E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-the-dangers-of-unfurling-and-what-you-can-do-about-it.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-security-advisory-anthropic-slack-mcp-server-data-leakage.md
- E2: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-the-dangers-of-unfurling-and-what-you-can-do-about-it.md
- E3: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-aws-amazon-q-fixes-markdown-rendering-vulnerability.md