← Catalog
Research high discovered 2024-08-20

Data Exfiltration from Slack AI via Indirect Prompt Injection

A malicious instruction posted in a public Slack channel was ingested into Slack AI's RAG index, then coaxed the assistant to leak data from private channels — rendered as a clickable link that carried secrets to an attacker.

Execution Persistence Resource Development Credential Access Exfiltration

What happened

Catalogued by MITRE ATLAS as AML.CS0035, PromptArmor showed that private data could be exfiltrated from Slack AI via indirect prompt injection. The attacker posted a malicious instruction in a public channel; Slack AI ingested that post into its RAG index. Later, when a user asked Slack AI a question, the assistant retrieved the poisoned content and followed it — pulling data the user could access from private channels and rendering it as a clickable link whose URL smuggled the secret to the attacker.

The crux is a trust-domain collapse: content anyone can post (public channel) was allowed to issue instructions that operated over data only some can see (private channels).

Why it maps to ATLAS

  • AML.T0051.001 — LLM Prompt Injection: Indirect: the instruction arrives via retrieved channel content.
  • AML.T0070 — RAG Poisoning: the public post poisons the assistant’s retrieval index.
  • AML.T0066 — Retrieval Content Crafting: the post is crafted to be retrieved and obeyed.
  • AML.T0082 — RAG Credential Harvesting: private data/secrets are collected via retrieval.
  • AML.T0077 — LLM Response Rendering: the exfil rides a rendered link in the assistant’s output.

Detection notes

Keep trust domains apart: public, world-writable content must never instruct the assistant over private data. Sanitize retrieved content, constrain link rendering in output, and scope each query’s retrieval to the requester’s own authorized sources. Answers that pull private-channel data in response to a public-seeded query are the red flag.

Detection

Log sources

  • Slack AI retrieval/RAG index sources
  • Rendered-link / citation output logs
  • Cross-channel access patterns

Signals

  • Instruction-like posts in public channels entering the RAG index
  • Assistant output rendering links that encode private data
  • Answers pulling from private channels into a public-seeded query

Mitigations

  • Separate trust domains: don't let public content instruct over private data
  • Sanitize retrieved content; constrain link rendering in output
  • Scope retrieval to the requester's authorized sources per query