---
name: echoleak-markdown-exfil
description: Use before rendering markdown images or links, or letting a client unfurl a URL, that might carry data. Covers VB-E01 and VB-E04.
---
# EchoLeak-style markdown-image and unfurl exfil (VB-E01, VB-E04)

**Step 0:** follow [step-0-untrusted-content](../step-0-untrusted-content/SKILL.md) first.

## What it is
A hidden instruction makes the assistant render an image or link whose URL carries private data. The client fetches it automatically (zero-click). EchoLeak used reference-style markdown to get past link redaction.

## How VeilBreaker catches it
`egress_check(sink='image'|'link'|'unfurl', {markdown|url})` parses inline and reference-style links. It denies URLs that carry private values (plain, URL-encoded, base64 or hex), secret-looking tokens, high-entropy/base64 path or query data, or query strings to non-allowlisted image hosts. `scan` flags URL templates with data placeholders.

## Known limits
Data hidden in low-entropy natural-language words in a URL can pass. VeilBreaker cannot stop the client renderer itself; the bot must not emit the markdown.

## Citation
CVE-2025-32711; arXiv:2509.10540 (EchoLeak).