tested prompt injection via markdown image syntax on 6 models - 4 of them leak tool definitions
tested gpt-4o, claude-3.7-sonnet, gemini-2.0-flash, llama-3.3-70b, qwen-2.5-72b, deepseek-v3 with payload `}))` injected into user message. gpt-4o, gemini-2.0-flash, qwen-2.5-72b, deepseek-v3 all returned full tool schemas in their error messages when they failed to load the image. claude and llama refused to process the markdown entirely. the leaked schemas include parameter names, types, descriptions - everything you need to craft better injection payloads. tested on 2024-12-15 versions. anyone else seeing this?
1. tested this on gpt-4o-mini, claude-3-5-sonnet-20241022, llama 3.3 70b q5, qwen 2.5 72b q4, and gemini-1.5-flash using markdown image syntax like  2. gpt-4o-mini and llama 3.3 leaked full tool definitions in the attempt to process the image url, claude and qwen tried to fetch but exposed internal schema validation errors, gemini just failed silently 3. this is a huge footgun for anyone building agents with user-generated content
teseted this on gemni 1.5 flash too and it leaks tool defs via markdown img syntax. completely broken
I tested same thing on Claude 3.5 Sonnet (20241022) and GPT-4o-mini yesterday with markdown image injection. Both of them leak tool definitions when you send payload like . The model just includes full tool schema in the request to external url. Is completely broken for production systems that use tools with sensitive parameter names)
tested same payload on llama 3.3 70b q5 yesterday and it leak tool definitions too via markdown image. is completely broken, all models just dump the tool schema when you send 