When you click a link in your browser, you’re not just going to a website, you’re also sending the website the URL you requested. Websites commonly log requested URLs in analytics and server logs.

Normally, that’s fine. But an attacker can try to trick a model into requesting a URL that secretly contains sensitive information, like an email address, a document title, or other data the AI might have access to while helping you.

For example, imagine a page (or prompt) that tries to manipulate the model into fetching a URL like:

If a model is induced to load that URL, the attacker can read the value in their logs. The user may never notice, because the “request” might happen in the background, such as loading an embedded image or previewing a link.