Notion 3.0 AI Agents: How a Hidden Line in a PDF Turned the Web Search Tool Into a Data Pipe
Key takeaways
- →In September 2025, days after Notion 3.0 launched autonomous AI Agents, CodeIntegrity showed that a PDF with hidden text could hijack them.
- →The text posed as an internal task and told the agent to collect client names and revenue figures from the workspace and send them as a query to an attacker URL using the built-in web search tool.
- →This is Simon Willison's 'lethal trifecta' in practice. AgentGuard breaks it by refusing document-borne instructions and blocking workspace data leaving through tool calls.
- 1
Attacker crafts PDF with hidden instructions
- 2
User uploads it and asks the agent to summarize
- 3
Agent follows the embedded 'internal task'
AgentGuard rejects instructions from the uploaded file and blocks workspace data in the search tool call
- 4
Agent collects client names and revenue figures
- 5
Web search tool sends the data to attacker URL
- Affected
- Notion 3.0 AI Agents users (demonstrated by CodeIntegrity)
- When
- Published September 2025
- Impact
- Exfiltration of confidential workspace data such as client lists and financials
What happened
Notion 3.0 introduced AI Agents that can work across a workspace for long stretches: reading pages, editing databases and calling tools, including a web search tool that can fetch arbitrary URLs. CodeIntegrity researcher Abi Raghuram tested what happens when that agent reads a hostile file.
The PDF looked like a customer feedback report. Hidden in white text was an 'important routine task' that claimed authority, invented urgency and told the agent to compile a list of clients and their annual recurring revenue, then call the web search tool with a URL that put that data in the query string.
When the user asked the agent to summarize the report, it did as the hidden text said. The researchers reported that the attack worked with Claude Sonnet 4, a model with strong safety training, which shows that model alignment alone doesn't stop it.
Why nothing caught it
Security researcher Simon Willison calls this combination the lethal trifecta: an agent with access to private data, exposure to untrusted content and a way to communicate externally. Notion's agents had all three by design, and so do most enterprise agents shipping today.
- The PDF upload was a normal user action
- The agent's workspace permissions were legitimate
- The web search tool is a built-in, approved feature
- No human approved the outbound call
How AgentGuard would have stopped it
AgentGuard removes one leg of the trifecta at the moment it matters. Instruction lineage marks everything inside the uploaded PDF as content, not commands, so the 'routine task' carries no authority.
Task context does the rest. The user asked for a summary of one document. Gathering client revenue from across the workspace and sending it to a web search tool doesn't fit that task. AgentGuard blocks the tool call and records the attempt, so the security team sees exactly which file tried to command which agent.
What to do Monday
Every workspace agent with a web tool is one hostile document away from a leak.
- Map which agents combine private data, untrusted input and outbound tools
- Disable or restrict web tools for agents that read sensitive data
- Treat uploaded and shared files as untrusted AI input
- Log and review every agent tool call that leaves the tenant
The lesson
None of these attacks needed malware, stolen passwords or a phishing click. An AI agent with legitimate access read attacker-controlled content and acted on it. Vendor patches close one path at a time. AgentGuard closes the class: every agent action is judged against the agent's task, its Principal and where its instructions came from, with zero integration and deployment measured in days.
Frequently asked questions
What was the Notion AI Agents vulnerability?
CodeIntegrity showed that a PDF with hidden instructions could make Notion 3.0 AI Agents collect confidential workspace data and send it to an attacker using the built-in web search tool.
What is the lethal trifecta?
A term coined by Simon Willison for agents that combine access to private data, exposure to untrusted content and the ability to communicate externally. Together they make data exfiltration through prompt injection possible.
How does AgentGuard break the lethal trifecta?
AgentGuard refuses instructions that arrive inside content such as files, and blocks agent tool calls that move sensitive data outside the scope of the user's task.
See AgentGuard on your own environment
Zero integration. Live in days. We'll show you what your current stack is missing.