A planted reference reaches an assistant's answer and nobody clicks it — how does data leave?

## Two events, not one Picture a data-analysis assistant that answers questions over database rows and spreadsheets. One column is free text — a notes or description field an outsider filled in through a public form. The assistant retrieves the row, quotes that field back inside its answer, and the answer is displayed somewhere. People treat *the model answered* and *the answer was displayed* as a single event. They are two events, owned by different software, and only the second one touches the network. The model emits tokens; it opens no sockets. Every byte that leaves the organisation is written by a program downstream of the model. ## What a rendering surface does while it draws Display surfaces are not passive. Many of them resolve references as part of drawing the content: a chat surface expands a bare link into a preview card by fetching it; a mail or document viewer pulls embedded resources so the layout is complete; a digest generator builds thumbnails; a dashboard tile loads a remote asset a cell refers to. None of that requires a human gesture. The request is issued because the surface decided the answer contains something it should resolve in order to show the answer properly. That is the entire mechanism. If the answer carries a reference of a form the viewing client resolves, and the reference points at a host the attacker controls, then *displaying* the answer performs the fetch. ## What the construction gets past Two things, and they fail for different reasons. **The human.** The reviewer's mental model is that a link is dangerous only if someone clicks it. A click is a control that assumes a decision point. Here there is no decision point: the request happens before anyone has decided anything, often before anyone has read the sentence. A control that was never in the loop cannot be credited with stopping anything. **The output screen.** A screen applied after generation scores the answer text — is it harmful, does it disclose, does it read like an attack. What it sees is a bland summary with a reference in it, and it scores that harmless. The score is correct. Nothing in the text is harmful. The harm is in what a different program does with the text a moment later, and that behaviour is not a property of the prose. ## What actually leaves Two different things, and interviewers want them separated. First, a **signal**: the request itself. Its arrival establishes that a particular surface dereferenced a model-authored reference at render time. That single bit is often the whole objective of a first attempt, because the attacker cannot see which of the unknown clients is live. Second, whatever the model wrote **into the reference's own structure** — path segments, parameters — data smuggled inside something the client treats as an address rather than as content. Keep the direction of every claim straight. A received request proves the surface resolved the reference. It does not prove a person read the answer, it does not prove the model reliably produces the reference, and it does not prove that other surfaces behave the same way. ## What it costs the attacker More than it looks. Whoever writes the field is writing for a renderer they cannot see, cannot version and cannot test. Rendering behaviour differs per surface and per client release; sanitisers differ; some surfaces show answers as plain text and resolve nothing at all. A reference form that is live in one client is inert in the next. The feedback loop is also entirely one-way. Nothing comes back except a request that may never arrive, and its absence is unreadable: the field may never have been quoted, the answer may never have been displayed, the client may have rewritten the reference. That blindness is the defining cost of this class, and it is why the attacker prefers surfaces likely to be *numerous* over surfaces likely to be *interesting*. ## Where it stops working - The surface shows answers as plain text and resolves nothing while drawing. - The reference is a form the client displays rather than fetches. - The answer never quotes the field — the pipeline paraphrases, or the row is never retrieved. - A resolved preview is cached: the fetch happens once for that reference and never again, which also means a second observation attempt sees nothing. ## The sentence to have ready The egress channel is a property of the rendering surface, not of the model. The same answer text is inert in one place and a network request in another — and nobody clicked anything either way.