Robert TaFounder & CEO, Clarity · Building Hyper-Personalized Agents

How Hackers Steal Your Data Through a Single Chatbot Prompt

21 Apr 2026 · 1 min

Watch on YouTube

1:02

In this brief dialogue, Speaker A describes a novel prompt‑injection technique against chatbots that can render Markdown and access private data. By injecting a prompt that asks the bot to embed sensitive information (e.g., credit‑card numbers) into a Markdown image URL, the bot will render the image, causing the client to request the attacker‑controlled endpoint with the secret data in the query string, thereby exfiltrating it. Speaker B reflects on the broader implications, noting the heightened risk when such a chatbot is exposed to end users versus being confined to internal infrastructure, where the attack surface is limited to known pipelines.

Chapters

let's say I have a chatbot that can also render Markdown and access private information. I can basically try to prompt inject my chatbot to retrieve some private information and render it in the form of, say, a Markdown image. And when it loads that Markdown, it will go ahead and hit that endpoint that I control. So I can exfiltrate the data just by saying, oh yeah, add all the private information, my credit cards, whatever, as query params and raise that, go. Wow.
Yeah. That's, I didn't even think about that, but that makes sense. Thinking about what can access this, what content, what kind of data it has access to. That's interesting. Like even, oh, okay. Exposing it to a user versus it's just back in infra. Through only a pipe I know about, versus if I expose it to an end user, there's infinity things they could do. That's, yeah, no, that makes a lot of sense.