Bing Chat: Data Exfiltration Exploit Explained

This post describes how I found a Prompt Injection attack angle in Bing Chat that allowed malicious text on a webpage (like a user comment or an advertisement) to exfiltrate data.
The Vulnerability - Image Markdown Injection When Bing Chat returns text it can return markdown elements, which the client will render as HTML. This includes the feature to include images.
Imagine the LLM returns the following text:
 This will be rendered as an HTML image …

advertisement attack bing bing chat chat client data data exfiltration exfiltrate data exfiltration explained exploit html injection injection attack malicious prompt injection return text vulnerability