Data Exfiltration from Slack AI via Indirect Prompt Injection
Slack AI
Researchers demonstrated that private data can be exfiltrated from Slack AI using indirect prompt injection via public channel posts. The attack caused the AI to retrieve and execute malicious instructions, leaking sensitive API keys.
- first report
- 7 Nov 2025
- last update
- 7 Nov 2025
Timeline · 2
Sources · 2
News and write-ups
- 2025-11-07Data Exfiltration from Slack AI via indirect prompt injectionpromptarmor.substack.com · promptarmor.substack.com/p/data-exfiltration-from-slack-ai-via
Research and catalogues
- 2025-11-07Data Exfiltration from Slack AI via Indirect Prompt InjectionMITRE ATLAS · atlas.mitre.org/studies/AML.CS0035
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Research
- AI role
- Attack on AI
- categories
- Prompt injectionAgent hijackData leak
- severity
- 1 · Research / proof of concept
- targets
- Enterprise deployment
- owasp llm top 10
- LLM01:2025 Prompt InjectionLLM02:2025 Sensitive Information DisclosureLLM06:2025 Excessive Agency
- dates
- happened 20 Aug 2024 · first reported 7 Nov 2025
- origin
- MITRE ATLASDerived from MITRE ATLAS (Apache 2.0, © MITRE).
- record
- confidence 0.95 · created 2026-10-18 06:55Z · updated 2026-10-18 06:55Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# Data Exfiltration from Slack AI via Indirect Prompt Injection https://gcdradar.vercel.app/incidents/data-exfiltration-from-slack-ai-via-indirect-prompt-injectio · AIR-2025-0061 · closed 2025-11-21 - Lane: Research - Severity: 1 (Research / proof of concept) - Fix status: Fix status unknown - First reported: 2025-11-07 (happened 2024-08-20) - AI role: Attack on AI - Products: Slack AI ## Summary Researchers demonstrated that private data can be exfiltrated from Slack AI using indirect prompt injection via public channel posts. The attack caused the AI to retrieve and execute malicious instructions, leaking sensitive API keys. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2025-11-07: Data Exfiltration from Slack AI via indirect prompt injection (https://promptarmor.substack.com/p/data-exfiltration-from-slack-ai-via) - 2025-11-07: Data Exfiltration from Slack AI via Indirect Prompt Injection (https://atlas.mitre.org/studies/AML.CS0035) ## Sources - 2025-11-07 MITRE ATLAS: Data Exfiltration from Slack AI via Indirect Prompt Injection https://atlas.mitre.org/studies/AML.CS0035 - 2025-11-07 promptarmor.substack.com: Data Exfiltration from Slack AI via indirect prompt injection https://promptarmor.substack.com/p/data-exfiltration-from-slack-ai-via Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- closedLLM Desktop Applications AIKatz Extracts Authentication Tokens from LLM Desktop Apps
Research · since 2025 (approx.)
AI - closedCopilot Studio Data Exfiltration via Prompt Injections in Copilot Studio Agent
Research · since Jun 2025 (approx.)
AI - closedCursor Data Exfiltration via MCP Server Prompt Injection Targeting Cursor
Research · since 24 Jun 2025
AI - closedLenovo AI Chatbot Lena Cross-Site Scripting via Prompt Manipulation in Lenovo AI Chatbot
Research · since 18 Aug 2025
AI - closedMCP SDKs Credential Exfiltration via Remote Poisoned MCP Tool
Research · since 1 Apr 2025
AI - closedClaude Code GitHub Action Claude Code GitHub Action Secret Exposure via Prompt Injection
Research · since 5 Jun 2026
AI