Skip to content

Back to the catalog

The Innocent Courier: Covert Exfiltration Through Legitimate LLM Web Fetching
arxiv.orgpaper

The Innocent Courier: Covert Exfiltration Through Legitimate LLM Web Fetching

LLMLeak is an attack that abuses an LLM agent's legitimate web-fetching tool as a covert exfiltration channel for malware that cannot itself reach the internet. A local malicious component embeds a secret in a URL disguised as useful reference material (e.g. for a library migration task); when the LLM fetches it, the secret reaches an attacker-controlled DNS or web server, achieving a 79.7% attack success rate across eleven open-parameter models and working against real-world chatbots.

TL;DR Malware without network access smuggles data out by tricking an LLM agent's web-fetch tool into leaking a secret via an attacker-controlled URL/DNS.
Open original ↗
Document

What it is

LLMLeak, from researchers at TU Darmstadt and TU Graz, is a covert exfiltration technique that abuses an LLM chatbot's website-fetching tool rather than any prompt-injection or code-execution vector. It targets systems where malware has obtained a secret (e.g., an API or SSH key) but is blocked from direct outbound network communication by monitoring or allowlisting.

How it works

Malware embeds the secret into a URL and surfaces it inside attacker-crafted but innocent-looking output — the paper's example is a real torch.load() stack trace referencing a URL that claims to explain a library migration fix. The victim pastes this error into an LLM chatbot for help. The LLM's fetch tool, acting entirely within its intended function, requests the URL to "find more information," sending the secret to attacker infrastructure either as a DNS query (secret in subdomain, e.g. 123abc.example-domain.com) or an HTTP request (secret in path, e.g. example-domain.com/123abc). The attacker only needs to observe the incoming request at their DNS/web server — the response content and the LLM's reply to the user are irrelevant to the exfiltration, which completes the moment the request is made.

sequenceDiagram
    participant M as Malware (no net access)
    participant V as Victim
    participant L as LLM Chatbot
    participant A as Attacker server
    M->>V: Crafted error message w/ secret-in-URL
    V->>L: Pastes error for help
    L->>A: Fetch tool requests URL
    A-->>A: Secret decoded from DNS/HTTP request

Preconditions / Affected

Requires only that the victim (or an LLM agent acting on their behalf) pastes attacker-crafted text containing the URL into a chatbot with web-fetching enabled, and that the LLM chooses to invoke the fetch tool on it. No prompt injection, hidden characters, or homoglyphs are used, so the technique survives being retyped, copied as plain text, or even transmitted via screenshot — the authors note this lets it bridge air-gapped systems. It is explicitly designed to evade defenses aimed at prompt-injection detection, since no malicious instruction is ever given to the model.

Caveats

The excerpt does not include the paper's methodology for why models choose to fetch the embedded URL, defensive countermeasures, or which specific real-world chatbots were tested in the case study — these likely appear later in the paper, beyond what was fetched here.

Organisations named here

  • LLMLeak

Technologies named here

  • LLMLeak
  • Eleven open-parameter LLMs
  • LLM web fetching tool
  • Real-world chatbots
  • LLM

Techniques named here

  • Covert exfiltration via legitimate LLM web fetching

Threat actors named here

  • LLMLeak

Related in AI Security