Incident Overview
On August 20, 2024, researchers at PromptArmor demonstrated a critical vulnerability in Slack AI that allowed attackers to exfiltrate sensitive data from private channels through indirect prompt injection. The attack leveraged Slack’s natural language query feature to manipulate responses, revealing confidential information such as API keys to unauthorized parties. This exploit did not require direct access to the private channels or knowledge of the specific data being targeted. The vulnerability was made possible by Slack AI’s ingestion of messages from public channels—even those the querying user was not a member of—into its context window during response generation.
The attack chain began with an attacker posting a malicious instruction in a public Slack channel they controlled. This instruction was designed to manipulate Slack AI’s response when a user queried for sensitive data. The victim, unaware of the attacker’s presence in the channel, would unknowingly trigger the injection by querying Slack AI for information stored in their private channel. The manipulated response would then include a phishing link containing the exfiltrated data, which the attacker could harvest upon the victim clicking it.
Slack confirmed that the behavior of ingesting public channel messages—regardless of user membership—was intentional. However, the company later adjusted how Slack AI handled files and public-channel content in response to the findings. The incident highlighted that the attack surface for such vulnerabilities is defined by retrieval scope rather than direct model access, emphasizing the risks posed by indirect prompt injection in AI-assisted platforms.
Slack AI’s citation behavior failed to attribute responses to the attacker’s malicious messages, making detection and tracing nearly impossible. Additionally, the attacker’s message did not appear in the initial search results, further obscuring the source of the compromise.
Initially, Slack dismissed the evidence as insufficient, arguing that the data queried had already been exposed in a public channel—a claim PromptArmor disputed. The researchers emphasized the severity of the issue, particularly after Slack’s August 14 update, which expanded the attack surface by allowing Slack AI to ingest files from channels and direct messages. This change introduced new risks, such as indirect prompt injection via malicious files uploaded to Slack, which could originate from external sources entirely.
Possible Root Cause
The primary root cause of this vulnerability was Slack AI’s inability to distinguish between legitimate user queries and malicious instructions embedded in public channel messages. This limitation stems from a fundamental challenge in large language models (LLMs): their inability to differentiate between system prompts—intended instructions from developers—and user-provided context. When Slack AI ingested messages from public channels into its context window, it treated all text equally, including instructions planted by attackers.
The attack exploited indirect prompt injection, a technique where an attacker embeds malicious instructions in seemingly benign content. In this case, the attacker crafted a message in a public channel that, when combined with a user’s query for sensitive data, altered Slack AI’s response. The malicious instruction directed the AI to include a phishing link containing the exfiltrated data, bypassing traditional access controls. This method did not rely on traditional phishing tactics but instead manipulated the AI’s response generation process itself.
Slack’s design choice to allow queries of public channel messages—regardless of user membership—amplified the vulnerability. While this feature was intended to enhance usability by providing broader access to workspace information, it inadvertently created an avenue for attackers to inject prompts into contexts they could not otherwise access. The lack of granular control over what content was included in AI responses further exacerbated the issue, as Slack AI’s citation behavior failed to clearly attribute responses to their sources.
The August 14 update, which enabled Slack AI to ingest files from channels and direct messages, introduced an additional layer of risk. By expanding the scope of ingested content, the update increased the potential attack surface. Malicious files—such as PDFs containing hidden instructions—could now be uploaded to Slack and subsequently processed by Slack AI, enabling attacks that did not require direct interaction with the platform. This change underscored the broader challenge of securing AI systems against prompt injection when their retrieval mechanisms are not properly constrained.
Takeaways
- Indirect prompt injection poses a significant threat to AI-assisted platforms, particularly when these systems ingest unvetted or publicly accessible content. The Slack AI incident demonstrates how attackers can manipulate AI responses to exfiltrate sensitive data without direct access to the target information. This highlights the need for organizations to implement robust controls over what content is included in AI-generated responses.
- Retrieval scope defines the attack surface for AI systems, not just model access. Slack’s decision to allow queries of public channel messages—even those users were not members of—created an unintended vulnerability.
- Citation and transparency mechanisms are critical for detecting prompt injection attacks. Slack AI’s failure to clearly attribute responses to their sources made it difficult for users to identify manipulated content. Implementing verifiable citation practices and audit trails can help organizations detect and mitigate such attacks more effectively.
- File ingestion in AI systems introduces new attack vectors. The August 14 update to Slack AI, which enabled processing of uploaded files, expanded the potential for indirect prompt injection via malicious documents. Organizations should restrict AI systems from ingesting untrusted files until proper safeguards are in place to prevent exploitation.
- Responsible disclosure processes must account for evolving threats. As AI systems become more integrated into workflows, organizations must foster collaborative approaches to security research and disclosure to ensure timely mitigation of risks.
- Public channel sprawl exacerbates security risks. The incident revealed how attackers could exploit obscure or overlooked public channels to launch attacks. Organizations should implement policies to monitor and restrict the creation of unnecessary public channels, particularly those with limited membership, to reduce the attack surface for prompt injection.
- Prompt injection is an industry-wide challenge. This suggests that prompt injection is a systemic risk that requires coordinated efforts across the industry to address, including standardized security practices and continuous vulnerability assessments.