The model output is an untrusted input to the browser. The browser interprets a Markdown image as a request for a remote resource. The URL itself can carry private text in its path or query, and a request can expose network metadata even if the image fails. No script execution or model controlled tool is required. This is a different boundary from an agent deciding to invoke a tool: the renderer is doing work because it interpreted generated text as active content. The W3C Content Security Policy specification defines img-src precisely as a control on image fetches.

I would render generated answers as text plus a small, explicit set of safe elements. Do not allow raw HTML, arbitrary inline images, auto-embedded previews, iframes, or remote assets from model text. A maintained HTML sanitizer can help against XSS, but it is not a sufficient exfiltration policy if it leaves a perfectly valid remote image URL. Use an img-src policy that blocks arbitrary origins, and do not rely on the policy alone: a native client, an email export, or a future previewer may have different behavior. Generated URLs should be inert text until a user chooses to open them, with a clear destination. For citations, render a signed internal source identifier resolved by a trusted service after permission checking, rather than trusting a model supplied URL. For approved images, use server issued asset handles and a proxy that checks authorization and does not forward private prompt data to arbitrary hosts.

The follow-up matters: “could we proxy any image URL so the browser never talks to the attacker?” A blind proxy would still make the external request, now from our infrastructure, and might become an SSRF path into internal services. Its URL policy, DNS and redirect handling, size and content limits, and network egress must be explicit. Better, do not fetch URLs supplied by generated text. Admit images only from controlled assets or from a separate user authorized fetch workflow.

I would verify with a test answer containing Markdown image syntax, raw <img>, a link preview URL, an encoded query, and a redirect. Open it in every renderer and export path and watch actual requests, not just the HTML string. The product can keep clickable citations and its own images. It cannot let arbitrary generated text silently instruct a browser or preview service to call home.