Slack AI indirect prompt injection that could pull data from private channels

Security firm PromptArmor showed that Slack AI, the generative assistant built into Slack, could be steered by instructions planted in a public channel into leaking data from private channels the attacker could not see. The research was published on 20 August 2024, and Slack said it deployed a patch that day.

What happened

Slack AI answers user questions by retrieving messages from both public and private channels, including public channels the user has never joined. In the demonstrated attack, a victim keeps an API key in a private channel. The attacker, a member of the same workspace, posts a crafted instruction in a public channel. When the victim later asks Slack AI for the key, the planted text is pulled into the model context and the answer renders a link that embeds the key; clicking it sends the value to a server the attacker controls. A 14 August Slack update that brought files into Slack AI answers widened the ways such instructions could arrive.

Impact

Slack said it had no evidence of unauthorized access to customer data. Its statement described the scenario as a way for someone already in the workspace to phish users for certain data, and did not mention exfiltration from private channels. Whether the technique was used against any real workspace before the patch is not publicly known.

Response

PromptArmor said it informed Slack of its findings before publishing and was told that the searchability of public-channel messages across a workspace was intended behavior. Slack then launched an investigation and shipped a patch on 20 August.

Lessons for security leaders

Any assistant that reads content written by other people can be given instructions by those people. When enabling AI features in collaboration suites, review which sources the assistant can read, disable file ingestion where it is not needed, and forbid storing secrets in chat at all. Ask vendors how they stop model output from rendering attacker-controlled links, and treat a vendor answer of intended behavior as a risk to document, not a closed ticket.