One Pixel Wide

Your agent reads a customer's private CRM notes, then reads an inbound email instructing it to append an image to its reply. The reply renders a 1x1 image whose URL carries the notes in an n query parameter, pointing at a domain you have never seen. Nobody clicked anything, yet the notes reached the attacker. How did the data leave?

The encoded notes were written into the model's weights and recovered by the attacker later

The chat client auto-fetched the image, sending the encoded notes to the attacker

The model called an HTTP tool to fetch that URL while composing its reply

The URL is inert until the user clicks it, so the leak needed a separate phishing step