In August 2024, security firm PromptArmor reported that Slack AI could be manipulated by a message in a public channel into producing a link that would send a user's private API key to an attacker. The case shows that what an assistant can search sets what it can leak.
How it worked
The Register's report describes the chain this way:
- Slack AI can search public channels, including ones the user has not joined, and the private channels the user belongs to.
- An attacker created a public channel and posted a crafted message. It told the model to append a victim's API key to a URL as a parameter, framed as a "click here to reauthenticate" link.
- When a user asked Slack AI about the key, the model pulled in the attacker's message and showed the link. Clicking it would send the key to the attacker's server.
- A 14 August update added files from channels and DMs to Slack AI answers. PromptArmor said a malicious instruction hidden in a PDF could trigger the same chain, and that the attacker might not need to be in the workspace.
The vendor response
According to the article, Slack first told PromptArmor that public channel messages are searchable by all workspace members whether or not they have joined, and called that intended behavior. PromptArmor argued Slack had misunderstood the risk of prompt injection.
An update to the report quotes a Salesforce spokesperson saying the company investigated, that the scenario required very limited and specific circumstances, that a patch was deployed, and that there was no evidence of unauthorized access to customer data. PromptArmor advised administrators to restrict Slack AI's access to documents until a fix, a setting owners and admins can change.
The scope lesson
Each element on its own looks normal. Public messages are public. Private channels are private. The assistant, though, put both in one context window, and it treated attacker text as instructions.
Three design questions follow for any assistant that reads your data:
- What can it read in one session? Mixing low trust content (anything an outsider can write) with sensitive content is where harm starts.
- What can it output? A clickable link with data inside the URL is an exfiltration path. See markdown image exfiltration from LLM chat output.
- Who can add content? Public channels, shared files and email all let outsiders write into the context.
What to do
- Limit the assistant's sources to what the task needs.
- Keep untrusted content away from secrets, and keep secrets out of chat where you can.
- Strip or confirm links and images in model output.
- Give admins a control to narrow what the assistant can search, and review it.
A system prompt will not close the gap on its own. See can a system prompt stop prompt injection.
Safeguard's MCP Guardrail and policies can help limit what agents connected through MCP are allowed to reach.
Quick check
Was customer data confirmed to have been accessed?
The Salesforce statement quoted in the report said there was no evidence of unauthorized access to customer data.
What was PromptArmor's interim advice?
To restrict Slack AI's access to documents until the issue was fixed, using a setting that workspace owners and admins can configure.
Sources
Last reviewed: 19 October 2026.
