Disable Auto-Render of Untrusted Markdown Images & Links

External communication access is the configuration that allows a synthetic subject to communicate beyond the organization’s controlled environment. This may include Hypertext Transfer Protocol (HTTP) requests, webhooks, email, external Application Programming Interface (API) calls, auto-rendered links, auto-rendered images, file uploads, browser navigation, or allow-listed domains.

This configuration creates an elevated exposure condition because outbound communication can complete the path from internal data access to external disclosure. A synthetic subject that can access private data, process untrusted content, and communicate externally may be exposed to what Simon Willison describes as the “lethal trifecta” for AI agents.

The primary risk is synthetic subject egress. A manipulated prompt, retrieved document, tool response, or generated output may cause the synthetic subject to transmit sensitive data outward through a permitted channel. This may occur through obvious actions such as email or API calls, or through less visible channels such as rendered image requests, link beacons, proxy requests, markdown output, or repeated small outbound requests.

A related risk is unsafe allow-listing. Domains, Content Security Policy (CSP) rules, proxy services, or trusted destinations may become exfiltration paths if they are too broad, stale, expired, re-registered, or not tied to a specific business purpose. A destination may appear trusted to the platform while still being controllable by an attacker.

Investigators should review outbound tool calls, HTTP requests, email activity, web proxy logs, Data Loss Prevention (DLP) events, rendered links and images, destination allow-lists, CSP entries, payload sizes, request frequency, and the retrieval or prompt events preceding egress. Particular attention should be given to newly observed domains, recently expired or re-registered domains, auto-rendered resources, repeated small requests, and outbound activity following access to sensitive data.

Investigative Relevance

External communication access is relevant because outbound connectivity determines whether a synthetic subject can move information outside the environment. Even a read-only assistant may become high-risk if its output can trigger external requests or transmit sensitive content.

Indirect untrusted-content invocation occurs when attacker-controlled or low-trust content causes a synthetic subject to act. The effective instruction is embedded in data the synthetic subject retrieves, ingests, summarizes, renders, or processes, rather than being issued directly by the apparent operator.

This may include instructions hidden in email, webpages, documents, customer relationship management fields, support tickets, pull request comments, uploaded files, calendar invites, chat messages, tool outputs, or other content sources. The synthetic subject may treat the embedded instruction as part of the task context and execute it as if it were a legitimate command.

This invocation creates an elevated exposure condition because the person who triggers the synthetic subject may not be the person who supplied the effective instruction. An employee may ask an assistant to summarize a mailbox, review a document, process a lead, or inspect a pull request, while the actual behavioral instruction comes from external or attacker-controlled content previously placed in that source.

The primary risk is indirect prompt injection. A malicious instruction may cause the synthetic subject to retrieve private data, override constraints, call tools, generate outbound links, render images, transmit information, or combine internal data with an external communication path. This is especially significant where the same context contains private data, untrusted content, and outbound connectivity.

Investigators should review the ingested content, retrieval records, tool outputs, prompt and response logs, rendered links and images, external fetches, web proxy records, Data Loss Prevention (DLP) alerts, requester identity, and downstream tool calls. Particular attention should be given to instruction-like text in retrieved content, invisible or obfuscated payloads, auto-rendered markdown images, new or recently registered domains, character-by-character request patterns, and outputs that combine private data with an outbound channel.

Investigative Relevance

Indirect untrusted-content invocation is relevant because the apparent user request may be benign while the effective command is supplied by another party. The investigation must reconstruct not only who invoked the synthetic subject, but which retrieved or ingested content shaped the action.

Trusted channel camouflage occurs when synthetic subject activity, data movement, or external observation is hidden inside a channel that appears trusted, routine, or first-party. This may include image proxies, content delivery networks, citation rendering, preview systems, markdown images, link unfurling, browser fetches, or platform-controlled proxy services.

This opacity condition frustrates investigation because the channel may look normal to users and monitoring systems. A request to a trusted image proxy, collaboration platform, or first-party content delivery network may appear to be ordinary rendering behavior while carrying encoded data, beaconing to an attacker-controlled endpoint, or concealing the true destination path.

The primary risk is transport-path concealment. Sensitive data or behavioral signals may move through a permitted rendering or proxy channel rather than through an obvious export, email, file transfer, or external tool call. This can make the activity difficult to distinguish from legitimate image loading, citation previewing, or user-interface rendering.

A related risk is allowlist overtrust. First-party domains, stale Content Security Policy entries, image proxies, preview services, and trusted platform infrastructure may be treated as safe destinations. If those channels can carry attacker-controlled paths, query strings, or encoded identifiers, they can hide outbound movement inside approved traffic.

Investigators should review rendered output, raw markdown, image and link fetches, web proxy logs, first-party proxy requests, content delivery network activity, Content Security Policy allowlists, Data Loss Prevention events, payload patterns, request timing, and destination resolution. Particular attention should be given to high-entropy URLs, character-paced request sequences, newly seen paths on trusted domains, image-proxy traffic following sensitive retrieval, and rendering activity outside normal agent patterns.

Investigative Relevance

Trusted channel camouflage is relevant because the investigator may see traffic to an approved or first-party domain without recognizing that the channel carried unauthorized data or signals. The investigation must examine how data was encoded, routed, rendered, and proxied, not only whether the destination domain was allowlisted.

This section is distinct from data exfiltration and indirect prompt injection. The data leak belongs to Adverse Outcome, and the instruction that caused the rendering belongs to Invocation. This Opacity section concerns the channel camouflage that makes the movement difficult to observe and interpret.

This section is especially relevant where synthetic subjects render markdown, load images, generate links, produce citations, operate in browsers, use first-party proxies, or run inside platforms that automatically fetch external resources on behalf of generated output.

A collaboration suite assistant is an artificial intelligence system embedded into workplace tools such as email, chat, documents, meetings, calendars, and shared drives. It may summarize content, draft replies, search documents, identify actions, or perform tasks across an employee’s workspace.

This deployment pattern creates an elevated exposure condition because the assistant processes both trusted internal content and untrusted inbound material. Emails, calendar invites, shared documents, chat messages, and meeting notes may originate from external parties, compromised identities, or low-trust sources before entering the assistant’s context.

The primary risk is zero-click or low-interaction indirect prompt injection. A malicious instruction may be hidden in an inbound message, document, meeting invite, or chat thread and remain dormant until the assistant summarizes, searches, drafts, or acts on that content.

A related risk is excessive tenant reach. If broad connector permissions, service identities, shared indexes, or weak query-time access checks allow retrieval across the wider tenant, one mailbox, thread, document, or meeting record may expose information beyond the employee’s entitlement.

Investigators should review the assistant’s directive, tenant permissions, connectors, retrieval scope, logs, tool calls, rendered links, external content handling, and source provenance. Particular attention should be given to embedded instructions, retrieval outside the employee’s entitlement, and outputs that transmit, summarize, or link to sensitive material.

Investigative Relevance

Collaboration suite assistants are relevant to SITM because they sit inside ordinary organizational workflows and process the communications employees rely on every day. Their retrieval, summarization, and action capability may exceed what the employee expects or is authorized to access.

An in-app text generation feature is an embedded artificial intelligence capability that generates, summarizes, drafts, rewrites, or explains content inside an existing application surface. It may read documents, messages, records, tickets, notes, or other user-accessible content, then render output inline as part of the product workflow.

This deployment pattern creates an elevated exposure condition because the content the feature must ingest to perform its task can also become the manipulation vector. A malicious instruction hidden in a message, uploaded file, record, comment, or document may influence the generated output during an ordinary summarize, draft, or generate action.

The primary risk is that manipulated output appears as trusted application content. If links, images, markdown, or generated text are rendered inline, the feature may mislead the employee, expose sensitive content, or create an outbound path without a distinct synthetic subject identity in the activity trail.

Investigators should review the feature’s directive, input sources, rendering behavior, output logs, external link handling, image loading, markdown support, and provenance records. Particular attention should be given to hidden instructions in ingested content, output that includes external destinations, and whether generated text is distinguishable from user- or application-authored content.

Investigative Relevance

In-app text generation is relevant because it embeds synthetic subject output directly into trusted product workflows. The feature may appear to be a normal application function, while its output is shaped by untrusted content processed during the task.

A browser or desktop agent is an autonomous AI agent that operates through a real browser, desktop environment, or graphical user interface. It may read rendered pages, screenshots, documents, forms, or application windows, then click, type, navigate, copy, paste, upload, download, or submit information on behalf of a user.

This deployment pattern creates an elevated exposure condition because the agent acts inside the user’s authenticated session. It may interact with applications using the user’s existing cookies, tokens, permissions, and access rights, making its actions appear as ordinary user activity.

The primary risk is untrusted interface content. Any page, URL fragment, screenshot, document, form field, or rendered message the agent reads may become an instruction surface. A malicious page or document may redirect the synthetic subject into disclosing session data, submitting sensitive information, copying internal content, or revealing one-time codes while operating under the user’s authority.

Investigators should review the agent’s directive, browser session context, visited URLs, rendered content, screenshots, clipboard activity, form submissions, downloads, uploads, and application audit logs. Particular attention should be given to external pages processed before sensitive actions, unusual navigation paths, one-time code exposure, and actions taken inside authenticated sessions.

Investigative Relevance

Browser and desktop agents are relevant because they allow a synthetic subject to operate through the same interface and session as a human user. This can bypass traditional separation between advice and action, since the agent can directly interact with applications rather than only recommend steps.

Rendered-channel data exfiltration occurs when confidential or sensitive data leaves the organization through an output channel that a synthetic subject is permitted to render.

This adverse outcome creates organizational harm because data transfer may occur without a human intentionally sending a file, email, message, or export. The synthetic subject may generate or render content that causes a browser, collaboration platform, or application surface to make an outbound request containing sensitive data in the path, query string, encoded resource reference, or other request component.

The primary harm is unauthorized disclosure through a permitted display pathway. Data that the synthetic subject can access may be embedded into a rendered link, image, citation, or beacon and transmitted to an external destination or proxy-controlled endpoint. The transfer may appear as ordinary rendering behavior rather than a deliberate data export.

A related harm is reduced visibility. Rendered-channel exfiltration may not appear as a conventional file transfer or user-initiated outbound message. Investigators may need to correlate prompt history, retrieval events, generated output, browser rendering, proxy requests, Data Loss Prevention (DLP) alerts, and web proxy logs to reconstruct the disclosure path.

Investigators should review agent session output, rendered markdown, image and link fetches, citation behavior, browser or application rendering logs, web proxy records, DLP events, Content Security Policy (CSP) allowlists, destination domains, payload size, request timing, and source-content provenance. Particular attention should be given to high-entropy URLs, character-paced request sequences, newly seen or recently registered domains, image-proxy traffic, and outbound requests immediately following retrieval of sensitive data.

Investigative Relevance

Rendered-channel data exfiltration is relevant because the harmful outcome is the movement of protected information outside the organization through a channel that appears to be part of normal synthetic subject output rendering.

This sub-section is especially relevant where synthetic subjects can access internal data and produce rendered markdown, citations, preview links, images, browser output, collaboration messages, or application content that may trigger automatic external requests.