How AI Chatbot Prompt Injection Can Enable Click-Based and Potential Zero-Click Data Exfiltration

Summary

A security demo explains how URL-supplied prompts and indirect prompt injection could expose chatbot-accessible data through clickable links or outbound requests. Zero-click exfiltration depends on the agent’s tools and autonomy; the demonstrated target blocked markdown

Key points

• Guest Ads recommends threat-modeling chatbot tools, accessible data, rendering behavior and prompt-delivery options, and testing exfiltration paths against yourself.
• The host used Claude to inspect ChatGPT JavaScript and identify Q, prompt and M parameters for filling and sending prompts through a URL in an authenticated session.
• In a demonstration, a markdown link sent contact names to a tester-controlled server when clicked.
• Markdown images could potentially trigger zero-click exfiltration when rendered, but the tested chatbot blocked image rendering; the link-based method worked.
• Ads describes out-of-band exfiltration by placing data in a subdomain and receiving it through a DNS callback when an agent can make outbound requests.
• An indirect prompt injection planted in shared content could expose user-accessible data if an agent reads it; whether this needs a click depends on the agent’s tools and autonomy.