Slack AI and the Prompt Injection That Reached Into Private Channels

In August 2024, the security firm PromptArmor published research showing that Slack AI — the assistant Slack layers over a workspace's messages — could be manipulated through indirect prompt injection to surface data the requesting user was never allowed to see. The demonstration is one of the cleaner illustrations of why retrieval-augmented assistants inherit the trust problems of everything they read.

The mechanics matter, so here is the shape of it, as PromptArmor described. Slack AI answers questions by retrieving relevant messages from across a workspace, including public channels — which it can read even for users who are not members of them. An attacker creates a public channel and posts a message containing instructions rather than conversation. Those instructions sit in the corpus, waiting.

How the exfiltration worked

When a victim later asks Slack AI a question whose retrieval happens to pull in the attacker's planted message, the model treats the injected text as instructions. In the researchers' scenario, the payload tells the assistant to take a sensitive value — for example an API key the victim had posted in a private channel — and render it inside a Markdown link pointing at an attacker-controlled URL, with the secret tucked into the link's parameters. If the victim clicks, the secret is delivered to the attacker's server.

The vendor response, and the fair reading

Slack's owner, Salesforce, initially characterised aspects of the behaviour as intended — public-channel messages are, by design, searchable by all members. After media coverage, the company said it had investigated the specific scenario, deployed a patch, and had no evidence of unauthorised access to customer data. That framing deserves to be reported accurately: this was research demonstrating a plausible attack path with preconditions, not a confirmed breach of real customer data.

The preconditions do not make it academic. The attacker needs only the ability to post in a public channel — trivial in most large workspaces — and a victim whose query pulls the poisoned message into context. As vendors expand what an assistant ingests (files, uploads, connected apps), the surface for planting instructions grows with it.

It is worth situating this in the wider pattern. Indirect prompt injection — planting instructions in content the model will later read — is the defining web-application-style flaw of the LLM era, and Slack AI is simply a high-visibility instance. The reason it keeps recurring is structural: retrieval-augmented systems are valuable precisely because they read widely, and reading widely means reading things an attacker wrote. Until models can reliably tell a trusted instruction from untrusted text embedded in retrieved data — a problem no vendor has fully solved — the burden falls on architecture: constraining what the model can reach and what it can do with what it reads.

What defenders should take away

• Assume every retrieved document may carry instructions. Untrusted content — including public-channel text — should be treated as data, not commands, and clearly delimited before it reaches the model.
• Neutralise the exfiltration channel. Much of this class of attack relies on the model emitting a clickable link or image to an arbitrary URL. Restrict or strip model-generated links to unknown domains.
• Scope retrieval to the user's real permissions. If the assistant can reach content the user cannot, you have built a confused-deputy waiting to be exploited.
• Inventory your AI-connected surfaces. Every app that layers an LLM over your messages, tickets, or wikis inherits this risk; you cannot secure the ones you have not catalogued.

Slack AI's flaw was not a bug in the ordinary sense — it was the assistant faithfully doing what an attacker's message told it to. That is the defining hazard of retrieval-augmented AI, and defending against it starts with knowing which of your collaboration tools now read your data and act on it. You cannot defend what you have not discovered.