Notion 3.0 AI Agent Data Exfiltration via Prompt Injection
Date: 2025-09
Affected: Notion 3.0 AI Agent Data Exfiltration via Prompt Injection
Attack vector: prompt-injection
Category: real-world
Severity: Medium

Notion 3.0's AI agents enable the "lethal trifecta": access to private data, exposure to untrusted content, and ability to externally communicate. Attackers hide prompt injection in PDFs (white text on white background) to cause the AI agent to collect confidential data and exfiltrate it via crafted web search queries.


Mitigations:

Architectural layers (MAESTRO):