STUPID-2026-0053
Slack AI could be tricked into leaking private-channel data via indirect prompt injection
Why 8/10
Private-channel data could be exfiltrated via prompt injection when a victim queried Slack AI. Patched; Slack reports no unauthorised access.
- Scope
- 3/4
- A whole machine or drive, an organisation's production system or data, or many credentials
- Recoverability
- 3/3
- Permanently lost or irreversible, including data that was exposed
- Did it happen
- 1/2
- Demonstrated (proof of concept, reproduction, controlled test or near-miss) with no real victim reported
- Beyond the user
- 1/1
- Production systems, customers or third parties, or credentials and sensitive personal data
The score is the sum of these four factors. How each factor is scored · scored 2026-10-29
Instruction given
Use Slack AI to summarize channels and answer questions.
Expected behavior
Only surface data the requesting user is authorized to see; ignore instructions planted in channel content.
Actual behavior
An attacker with only the ability to post in a public channel could plant instructions that Slack AI would later execute for a victim with private-channel access — rendering exfiltration paths as clickable links that encoded private-channel content (including secrets from DMs). Slack also fetched data from public channels the user had never joined.
Damage
Private-channel data and DM secrets could be exfiltrated by an attacker who never had access to them. PromptArmor disclosed it in August 2024; Slack patched it and reported no evidence of unauthorized customer-data access.
Full write-up
In August 2024, the PromptArmor team disclosed an indirect prompt-injection flaw in Slack AI that allowed data exfiltration from private channels and DMs the attacker couldn't access. The core problem: Slack AI let user queries fetch data from both public and private channels — including public channels the user hadn't even joined. An attacker with only the ability to post in a public channel could plant adversarial instructions that any Slack AI user with private-channel access would later unknowingly execute when summarizing or asking questions. The model rendered exfiltration paths as clickable links that encoded private content — including secrets pasted into DMs — in the URL, so the attacker never needed access to the private data themselves. A same-week Slack update that pulled files from channels and DMs into AI answers only widened the attack surface. Slack deployed a patch and said it had no evidence of unauthorized access.
Classification
- Agent
- Slack AI
- Failure mode
- Security Vulnerability
- Root cause
- Tool Misuse
- Domain
- Backend
- OWASP Agentic Top 10 (our mapping)
- ASI01 Agent Goal Hijack · ASI02 Tool Misuse and Exploitation list
- MIT AI Risk Repository (our mapping)
- 2.2 AI system security vulnerabilities and attacks · 2.1 Compromise of privacy by leaking or correctly inferring sensitive information taxonomy
- Source
- News Report
Related incidents
Cite this record
StupidLLM. "STUPID-2026-0053: Slack AI could be tricked into leaking private-channel data via indirect prompt injection." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0053/ (accessed 2026-10-29). CC BY 4.0.
← STUPID-2026-0052By IDSTUPID-2026-0054 →
Get told when an agent breaks something
We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.
This database is callable over MCP — query it from inside your agent.