Review a RAG copilot for data exfiltration risk

security, rag, exfiltration, prompt-injection

Prompt

A security researcher asks you to assess the data-exfiltration risk of your company's internal copilot. It's a RAG system over an internal wiki, and it renders model output as markdown in the chat UI, including links and images. Design the review and the fixes.

Interviewer's answers to clarifying questionsopen after you have asked your own

What can the copilot read? Every wiki space the requesting employee has access to, including spaces with externally-shared or externally-editable pages.
What does the UI do with model output? Renders markdown client-side; images and link previews auto-fetch by default.
Attack surface considered? Any page reachable by the copilot could contain attacker-controlled instructions or formatting (indirect injection via a page someone pasted in).
Current output filter? Strips the exact pattern [text](url) only.
Business constraint? Product wants image and link previews to stay, because employees rely on them for visual wiki content.
Timeline? Ship the review and fix within 2 weeks; there's no budget for a full external pentest this quarter.

Follow-upsafter your high-level design

How would you red-team your own output filter against every markdown link/image syntax variant: inline, reference-style, HTML-embedded, and encoded?
What's your actual CSP allowlist for auto-fetched images and link previews, and have you verified none of those domains proxy arbitrary external URLs?
A vendor's "AI guardrails" product claims to block 97% of known exfiltration patterns. Does buying it change your answer here?
Six weeks after launch, you learn an attacker-controlled wiki page caused a real exfiltration via an image URL with query-string-encoded data. Walk through root cause and the fix.

Answer first: out loud, on paper, or with the interview prompt above. Then compare with the rubric.