Correct. That's just focused on the zero click scenario of unfurling.

The tricky part with a markdown link (as shown in the Slack AI POC) is that the actual URL is not directly visible in the UI.

When rendering a full hyperlink in the UI a similar result can actually be achieved via ASCII Smuggling, where an attacker appends invisible Unicode tag characters to a hyperlink (some demos here: https://embracethered.com/blog/posts/2024/ascii-smuggling-an...)

LLM Apps are also often vulnerable to zero-click image rendering and sometimes might also leak data via tool invocation (like browsing).

I think the important part is to test LLM applications for these threats before release - it's concerning that so many organizations keep overlooking these novel vulnerabilities when adopting LLMs.