Slack AI Leaks Private-Channel Data via a Public Message
On this page
A message in a channel you never joined, reaching into a private channel you did.
| When | August 2024 |
|---|---|
| Target | Slack AI |
| Vendor | Slack (Salesforce) |
| Researcher | PromptArmor |
| Technique | Indirect injection in a public channel → private-data exfil |
| Disclosed | Reported Aug 14; detailed Aug 20, 2024 (no CVE) |
- 1Attacker posts hidden instructions in a public channel they need not join
- 2A victim asks Slack AI something; retrieval pulls the attacker's message alongside private data
- 3Slack AI renders a crafted link that sends the private secret to the attacker when clicked
What happened
In August 2024, PromptArmor showed that an attacker with any account in a Slack workspace could post malicious instructions in a public channel — one they did not even have to join — and cause Slack AI to leak data from a victim's private channel. The screenshots and writeup circulated widely; Slack deployed a patch and characterised the scenario as requiring narrow conditions.
How the attack worked
Slack AI's retrieval draws on public channels the querying user has not joined. The attacker's planted instructions were retrieved into the same context as the victim's sensitive data (for example an API key in a private channel), and executed. Slack AI then rendered attacker-crafted markdown — a “reauthenticate” link — that carried the secret to the attacker's server as a URL parameter when clicked.
A confused deputyThe assistant had legitimate access to the victim's private data and was tricked, by untrusted public content, into handing it to a third party.
Root cause
Untrusted retrieved content shared a context with privileged data, and the assistant could render arbitrary links — so injected instructions could both reach secrets and ship them out.
What a test would have caught
An indirect-injection test that plants instructions in retrievable content and checks whether the assistant will surface cross-scope data or render an outbound link would have flagged this before launch.
How to prevent it
- Scope retrieval to what the querying user should actually see.
- Isolate untrusted content from privileged data in the context.
- Don't render arbitrary links or markdown that can carry data to external hosts.
Feel it yourselfThe replay lab lets you smuggle instructions through untrusted content and exfiltrate data out-of-band — the Slack-AI pattern.
FAQ
How could a public message reach private data?
Slack AI's retrieval draws from public channels the querying user hasn't joined. An attacker planted instructions in such a channel; when a victim later asked Slack AI something, those instructions entered the same context as the victim's private data and were executed.
What was actually leaked?
In the researchers' demonstration, a secret such as an API key that a user had put in a private channel — rendered by the AI into a “reauthenticate” link that sent the secret to the attacker as a URL parameter when clicked.
What's the fix?
Isolate untrusted retrieved content from privileged data, don't let the assistant render arbitrary links/markdown, and scope retrieval to what the querying user should actually see.
Sources
- Data Exfiltration from Slack AI via Indirect Prompt Injection — PromptArmor
- Slack AI can leak private data via prompt injection — The Register
- Data exfiltration from Slack AI via indirect prompt injection — Simon Willison's Weblog