Slack AI Prompt Injection: Stealing Secrets From Private Channels You Can't Access
Key takeaways
- →PromptArmor showed that Slack AI could be manipulated by a message in a public channel to leak data from private channels into an attacker's link.
- →The AI feature came from the SaaS vendor. Most customers never threat-modeled it.
- →AgentGuard detects vendor-added AI features and blocks out-of-task data rendering into external links.
- 1
Attacker posts crafted message publicly
- 2
Victim queries Slack AI
- 3
AI retrieves attacker message + private data
- 4
AI renders secret inside malicious link
AgentGuard blocks secrets from being embedded in externally-bound links
- 5
Click sends secret to attacker
- Affected
- Slack AI users (research disclosure)
- When
- August 2024
- Impact
- Potential exfiltration of private-channel secrets
What happened
In August 2024 PromptArmor published research showing that Slack AI's retrieval could be poisoned. An attacker posted a message with instructions in a public channel. When a victim asked Slack AI for something like an API key stored in their private channel, the assistant combined the two and produced a link that would send the secret to the attacker when clicked.
The injected-AI problem
Slack AI is a textbook case of injected AI: an agentic feature added by a trusted vendor that changes your threat model overnight. Security teams who approved Slack years ago never approved an LLM reading across channels.
How AgentGuard would have stopped it
AgentGuard detects when SaaS vendors enable AI features in your tenants, maps their data reach, and inspects their actions for instruction lineage and out-of-task data movement, including secrets encoded into external URLs.
The lesson
Every incident in this series shares one root cause: an AI system acted with real authority, and nothing in the stack was checking whether that action made sense for its task, its Principal or its environment. That's the gap AgentGuard was built to close, with zero integration and deployment measured in days.
See AgentGuard on your own environment
Zero integration. Live in days. We'll show you what your current stack is missing.