<story><title>Data Exfiltration from Slack AI via indirect prompt injection</title><url>https://promptarmor.substack.com/p/data-exfiltration-from-slack-ai-via</url></story><parent_chain><item><author>simonw</author><text>The key thing to understand here is the exfiltration vector.&lt;p&gt;Slack can render Markdown links, where the URL is hidden behind the text of that link.&lt;p&gt;In this case the attacker tricks Slack AI into showing a user a link that says something like &amp;quot;click here to reauthenticate&amp;quot; - the URL attached to that link goes to the attacker&amp;#x27;s server, with a query string that includes private information that was visible to Slack AI as part of the context it has access to.&lt;p&gt;If the user falls for the trick and clicks the link, the data will be exfiltrated to the attacker&amp;#x27;s server logs.&lt;p&gt;Here&amp;#x27;s my attempt at explaining this attack: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;simonwillison.net&amp;#x2F;2024&amp;#x2F;Aug&amp;#x2F;20&amp;#x2F;data-exfiltration-from-slack-ai&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;simonwillison.net&amp;#x2F;2024&amp;#x2F;Aug&amp;#x2F;20&amp;#x2F;data-exfiltration-from...&lt;/a&gt;</text></item></parent_chain><comment><author>wunderwuzzi23</author><text>For bots in Slack, Discord, Teams, Telegram,... there is actually another exfiltration vector called &amp;quot;unfurling&amp;quot;!&lt;p&gt;All an attacker has to do is render a hyperlink, no clicking needed. I discussed this and how to mitigate it here: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;embracethered.com&amp;#x2F;blog&amp;#x2F;posts&amp;#x2F;2024&amp;#x2F;the-dangers-of-unfurling-and-what-you-can-do-about-it&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;embracethered.com&amp;#x2F;blog&amp;#x2F;posts&amp;#x2F;2024&amp;#x2F;the-dangers-of-unf...&lt;/a&gt;&lt;p&gt;So, hopefully Slack AI does not automatically unfurl links...</text></comment>
<story><title>Data Exfiltration from Slack AI via indirect prompt injection</title><url>https://promptarmor.substack.com/p/data-exfiltration-from-slack-ai-via</url></story><parent_chain><item><author>simonw</author><text>The key thing to understand here is the exfiltration vector.&lt;p&gt;Slack can render Markdown links, where the URL is hidden behind the text of that link.&lt;p&gt;In this case the attacker tricks Slack AI into showing a user a link that says something like &amp;quot;click here to reauthenticate&amp;quot; - the URL attached to that link goes to the attacker&amp;#x27;s server, with a query string that includes private information that was visible to Slack AI as part of the context it has access to.&lt;p&gt;If the user falls for the trick and clicks the link, the data will be exfiltrated to the attacker&amp;#x27;s server logs.&lt;p&gt;Here&amp;#x27;s my attempt at explaining this attack: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;simonwillison.net&amp;#x2F;2024&amp;#x2F;Aug&amp;#x2F;20&amp;#x2F;data-exfiltration-from-slack-ai&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;simonwillison.net&amp;#x2F;2024&amp;#x2F;Aug&amp;#x2F;20&amp;#x2F;data-exfiltration-from...&lt;/a&gt;</text></item></parent_chain><comment><author>jjnoakes</author><text>It gets even worse when platforms blindly render img tags or the equivalent. Then no user interaction is required to exfil - just showing the image in the UI is enough.</text></comment>