That is because you haven’t close php before anchor tag
<?php $args = array( 'post_type' => 'xyz', 'posts_per_page' => -1, 'orderby' => 'rand' );
$loop = new WP_Query( $args );
while ( $loop->have_posts() ) : $loop->the_post(); ?>
<a href="https://wordpress.stackexchange.com/questions/66197/<?php the_permalink(); ?>" title="<?php the_title_attribute(); ?>" >
<?php the_post_thumbnail('wine-flow', array('class' => 'item')); ?>
</a>
<?php
endwhile; ?>