Slack AI could be tricked into leaking private-channel data via indirect prompt injection

In August 2024, the PromptArmor team disclosed an indirect prompt-injection flaw in Slack AI that allowed data exfiltration from private channels and DMs the attacker couldn't access. The core problem: Slack AI let user queries fetch data from both public and private channels — including public channels the user hadn't even joined. An attacker with only the ability to post in a public channel could plant adversarial instructions that any Slack AI user with private-channel access would later unknowingly execute when summarizing or asking questions. The model rendered exfiltration paths as clickable links that encoded private content — including secrets pasted into DMs — in the URL, so the attacker never needed access to the private data themselves. A same-week Slack update that pulled files from channels and DMs into AI answers only widened the attack surface. Slack deployed a patch and said it had no evidence of unauthorized access.