Executive Summary
A prompt-injection technique can cause an LLM to conceal sensitive data in a deceptive hyperlink, allowing exfiltration when a user clicks it. Organizations operating LLM applications or AI agents should address this as a prompt-injection and data-leakage risk.
What Happened
Trend Micro described a prompt-injection technique that causes an LLM to embed sensitive collected data in a hyperlink disguised as a normal reference. Clicking the link can enable attacker-controlled data exfiltration, even when the AI lacks direct external connectivity permissions.
Affected Products
- LLM
Vulnerability / Attack Technique
Prompt injection via deceptive hyperlink
Technical Mechanism
The prompt injection causes the LLM to embed sensitive collected data in a hyperlink presented as a normal reference. User interaction with the link can send the attacker-controlled data outward despite the AI lacking direct external connectivity permissions.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
This technique shows that restricting an LLM's direct network access may not prevent data exfiltration if users can act on model-generated links. Teams should evaluate rendered references, URLs, and other output channels as part of AI-agent business-logic and adversarial testing.
Recommended Controls
- Inspect and sanitize model-generated hyperlinks before displaying or enabling them.
- Block or require explicit confirmation for links containing encoded, embedded, or unusually long data.
- Apply data-loss-prevention checks to model outputs and generated URLs.
- Use AI red teaming to test prompt-injection paths that encode sensitive data in user-clickable content.
- Limit exposure of sensitive context to the LLM and log link generation and user-click events for detection.
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
AI Threat Watch: https://ai-threat.watch/ai-targeted/
Summary and analysis written by RealGround from the source above; last updated 2026-10-22.