Obfuscated Imprompter prompt makes Mistral's Le Chat leak users' personal data
Researchers from UC San Diego and Nanyang Technological University showed that an automatically generated prompt that looks like gibberish could make Mistral AI's Le Chat pick out personal information from a conversation, such as names, ID numbers and payment card details, and send it to an attacker's server through a Markdown image link, while showing the user only an invisible 1x1 pixel. The attack succeeded nearly 80 percent of the time in end-to-end tests. Mistral treated it as a medium-severity issue and fixed it by stopping the Markdown renderer from loading external URLs.
The attack needs a user to paste the adversarial prompt into a chat, for example after being persuaded it would improve their CV; the researchers pointed to websites that share prompts. The same technique also worked against the Chinese chatbot ChatGLM.
What would have stopped it
Stop chat interfaces from loading images or links to arbitrary external URLs composed by the model.
Guardrails
- G1 Least privilege Not assessed Did the agent hold only the access the task needed?
- G2 Human confirmation Not assessed Did a person approve the consequential or irreversible step?
- G3 Isolation Failed Markdown renderer fetched attacker URLs, giving the model a channel to outside servers.
- G4 Instruction integrity Failed Le Chat followed obfuscated instructions to collect and send out personal data.
- G5 Truthfulness Failed The leak was hidden from the user behind an invisible pixel.
- G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
- G7 Oversight Not assessed Could a responsible human see what it was doing and stop it in time?
- G8 Recovery Not assessed Could the damage be undone?
Sources
-
“For example, we show an information exfiltration attack on Mistral's LeChat agent that analyzes a user's conversation, picks out personally identifiable information, and formats it into a valid markdown command that results in leaking that data to the attacker's server.”
-
“Mistral AI tells WIRED it has fixed the security vulnerability—with the researchers confirming the company disabled one of its chat functionalities.”
-
“The paper describes an exfiltration attack against numerous targets including Mistral's LeChat (since patched - they locked down Markdown images, as all chat interfaces should), but the novel part of the paper is the way they obfuscate the attacks.”
Confidence 92% comes from these sources alone. How we score
History
- 15 Oct 2026Entered in the register with 3 sources