LLM Response Rendering
This is a security trick where a malicious actor tricks an AI into secretly sending your private data to their own website. The AI includes a hidden 'invisible' image in its reply, and when your app tries to load that image, it automatically sends your private information along with the request to the attacker.
An LLM response rendering attack occurs when an adversary prompts a model to output malicious markdown or HTML, such as an image tag, containing sensitive data within the URL parameters. Because the client application automatically fetches the resource to render the content, the sensitive data is exfiltrated to an attacker-controlled server via the HTTP request headers or query strings without requiring user interaction.
LLM response rendering vulnerabilities exploit the trust relationship between a client-side renderer and the LLM's output. By injecting crafted markdown or HTML elements—specifically those triggering automated outbound requests like <img>, <script>, or <iframe> tags—an adversary forces the client to perform an unauthorized cross-origin request. The sensitive data, embedded as a query parameter or path component within the resource URI, is exfiltrated to an adversary-controlled endpoint upon the client's automatic resolution of the resource, bypassing user-level visibility and interaction requirements.