Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Disclosed vulnerability

Data exfiltration from Slack AI private channels via indirect prompt injection in a public channel

AIR-2024-0035 AIR record · 2024-08-slack-ai-private-channel-exfiltration
Open in dashboard About
From the supporting source
This vulnerability can allow attackers to steal anything a user puts in a private Slack channel by manipulating the language model used for content generation.promptarmor.substack.com
The record
Disclosed
2024-08-20
Vendor
Slack (Salesforce)
Product
Slack AI
Risk domain
Reliability and observability › Data and memory poisoning
Also touches
Credential theft, Data exfiltration channels, Human manipulation, Confused deputy
System type
Generative model
Who acted
Agent acted — Slack AI retrieved the private channel and rendered the exfiltration link
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection message
Impact type
Data exfiltration, Credential theft, Phishing
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI06 – Memory & Context Poisoning
MITRE ATLAS
AML.T0020 – Poison Training Data
NIST AI RMF
MEASURE 3.1
EU AI Act
Article 15
ISO/IEC
TR 24028; 24029-1; 23894
AIUC-1
D. Reliability
Scope
agent failure
Mitigation
Monitor model performance; Implement feedback diversity and circuit breakers.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
any Slack workspace with Slack AI enabled
Capability abused
retrievallink_renderingcross_channel_retrievalfile_ingestion
Defense & remediation
Recorded defense
none specific to prompt injection
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
Slack pushed a patch for the private-channel case but classified public-channel searchability as intended behavior
Taxonomy & references
OWASP ASI01 Agent Goal HijackOWASP ASI06 Memory & Context PoisoningOWASP ASI03 Identity and Privilege AbuseATLAS AML.CS0035rag_poisoningcross_tenant_boundaryprivate_channel_leakindirect_prompt_injectionscope_violationmarkdown_link_exfil
Curator notes
PromptArmor. Attacker needs only a non-admin account and a public channel post; victim need not be in that channel. | Merged from duplicate id `2024-08-slack-ai-channel-exfil`. Also reported as: 'Slack AI data exfiltration from private channels via indirect prompt injection'.
Supporting sources
Cite as
Enkrypt AI. "Data exfiltration from Slack AI private channels via indirect prompt injection in a public channel". AIR, AIR-2024-0035. https://agentincident.vercel.app/i/AIR-2024-0035/ (accessed 2026-10-19).