Slack AI - Data Exfiltration via Indirect Prompt Injection

Summary

In August 2024, PromptArmor published a demonstration against Slack AI, the assistant that answers questions using messages in a Slack workspace. The researchers showed that text posted in a public channel could be pulled into another user's Slack AI answer and steer that answer so that private data the victim could see was embedded in a link pointing to an external destination.

This record is a research demonstration. It shows that the product could be manipulated in a controlled test. It is not evidence that attackers exploited Slack customers.

Classification and evidence status

Affected system and trust path

Slack AI searched messages the asking user was allowed to see, including public channels they had not joined, and combined them with the user's own private content in one answer. A message from any workspace member in a public channel is variable content, but in the answer it was treated as equally relevant material next to private data.

The researchers also noted that a product change on 2024-08-14 added uploaded files and other documents to what Slack AI could draw on. They stated that they had not tested that change but believed it widened the surface.

High-level attack chain

At a high level: an attacker who is a member of the workspace posts a message in a public channel; a different user asks Slack AI about something that only exists in their private conversations; Slack AI retrieves both the private item and the attacker's message; the answer follows the attacker's text and presents a link; if the user clicks it, the private data carried in that link reaches a server the attacker controls.

The disclosure also describes a related phishing variant in which the rendered link only led the user to an attacker page. This record does not reproduce message wording or link construction.

Demonstrated impact vs observed exploitation

Demonstrated: a secret stored in a private conversation was placed into an attacker-controlled link; exfiltration depended on the victim clicking that link.

Observed against real customers: none reported in the cited source. Influencing the answer is model influence; the security impact came from the link output channel combined with access to private content.

Enabling control gaps

• Content from other workspace members was mixed with private content without a provenance distinction that constrained how it could shape the answer.
• Answers could contain links to arbitrary external destinations, creating an outbound path for data from the model context.
• Retrieval relevance alone decided what entered the context; relevance does not establish trust or instruction authority.

Vendor and researcher response

According to PromptArmor's timeline, the issue was reported to Slack before publication. Slack's response at that time, quoted in the disclosure, said that it considered the evidence insufficient and described public channel messages being searchable by all workspace members as intended behavior. After publication, Slack stated that it deployed a patch on 20 August 2024 and found no evidence of unauthorized access to customer data.

Evidence defenders should retain

• Which messages and channels were retrieved for each AI answer, including authors of public-channel items.
• Links contained in AI answers and whether users clicked them.
• Proxy or DNS logs for requests to unfamiliar domains following AI answer views.
• New public channels with few members and messages that were retrieved in other users' answers.

Defensive lessons

• Data Provenance: record who authored each retrieved item and keep that label available to policy.
• Information Flow Control: block or neutralize links in AI answers that would carry context data to unapproved destinations.
• Output Validation: check the structure of answers, for example which link targets are allowed, separately from rendering and encoding.
• Prompt Injection Detection: monitoring can flag suspicious retrieved content, but it is a signal, not permission logic.

Related Learn topics

• RAG and Retrieval - How RAG works as an application architecture: the retrieval pipeline, why relevance is not trust, security trimming, provenance, citations and derived state.
• What Is Prompt Injection? - Concept-first definition, direct vs indirect, and why instruction-control failure is not the same as security impact.