Slack AI indirect injection via channel content
Date: 2024-08-20
Affected: Slack AI summarisation feature — all Slack workspaces with Slack AI enabled; attack vector is any public or shared channel the target user's AI can access
Attack vector: adversarial-input
Category: research-demonstrated
Severity: Critical

Security researcher PromptArmor (August 2024) demonstrated that Slack AI's summarisation feature — which retrieves and summarises channel messages — could be exploited via indirect prompt injection. An attacker posts a message in any public or shared Slack channel containing adversarial instructions. When a target user asks Slack AI to summarise the channel, the AI reads the attacker's message and follows the injected instructions, which can include exfiltrating private data from other channels the user has access to, or returning phishing links as part of the summary. Slack confirmed the vulnerability and issued a fix, but the incident established that production SaaS AI summarisation features are vulnerable to indirect injection via user-generated content.

Impact: Demonstrated cross-channel data exfiltration via AI summarisation in production SaaS; attacker in one channel can pivot to access data from private channels via the victim's AI context; Slack confirmed and patched

Mitigations:
Audit log of all channels accessed per AI summarisation request
Output review: detect instruction-like patterns or URLs in AI summaries before display
Retrieved content treated as untrusted data — never as instructions
Strict scoping: AI summarisation must only access the explicitly requested channel, not cross-reference others

Architectural layers (MAESTRO):
label: Data Operations
notes: Adversarial instruction in retrieved channel content — user-generated content used as injection vector
role: origin
label: Agent Frameworks
notes: AI assistant executes instruction from retrieved content without content trust boundary
role: propagation
label: Agent Ecosystem
notes: Cross-workspace data exfiltration via agent capabilities — pivot from one channel to private channels
role: impact
label: Evaluation & Observability
notes: No validation of retrieved content before AI processing
role: blind-spot
label: Security & Compliance
notes: No alert on AI accessing channels outside summarisation scope
role: blind-spot