# covert channel data exfiltration

The paper introduces LLMLeak, a novel attack vector in which malicious software that runs locally but cannot reach the internet directly encodes a secret into a URL and presents the referenced site as information needed for a benign task such as migrating a software library, inducing the LLM to fetch that URL through its web-fetch tool so the attacker receives the encoded secret via an attacker-controlled DNS or web server; evaluation on eleven open-parameter models shows a 79.7% attack success rate, with a case study on real-world chatbots.

The paper introduces LLMLeak, a novel attack vector in which malicious software that runs locally but cannot reach the internet directly encodes a secret into a URL and presents the referenced site as information needed for a benign task such as migrating a software library, inducing the LLM to fetch that URL through its web-fetch tool so the attacker receives the encoded secret via an attacker-controlled DNS or web server; evaluation on eleven open-parameter models shows a 79.7% attack success rate, with a case study on real-world chatbots.