This is concerning to me as well. Since images auto load, it's easy for the computer serving the image to harvest IPs and maybe the server can even tell that hexbear was the source of the request. (I'm on my phone so I can't check right now but this part at least can be disabled on hexbear's side.) But a malicious actor could easily make a hexbear-unique image url even if hexbear is setting the proper headers or attributes on the image.

I suppose a malicious actor could also do this with links to external domains, but I think the ability for it to be passively collected makes it worse.

I noticed that @RondoRevolution@hexbear.net put the image in a spoiler; I wonder if it works even un-spoilered. (Edit: it does.)