Disclosed vulnerability
Anthropic's Slack MCP server leaks data through Slack link unfurling
AIR-2025-0047 AIR record · 2025-06-anthropic-slack-mcp-unfurl
From the supporting source
When posting to channels, Anthropic's Slack MCP server does not disable unfurling of hyperlinks.embracethered.com
The record
Disclosed
2025-06-24
Vendor
Anthropic
Product
Anthropic Slack MCP Server
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — the agent posted the link that Slack unfurled, sending data out
Attack surface
MCP server
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection document
Impact type
Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
workspaces using the (now archived) Anthropic Slack MCP server
Capability abused
Defense & remediation
Recorded defense
none - unfurling not disabled
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
not fixed - the server was deprecated and archived 2025-05-29 with no patch planned; Anthropic declined a CVE but approved public disclosure
Taxonomy & references
Curator notes
Rehberger has warned about link unfurling as an agent exfiltration channel since April 2024.
Supporting sources
Cite as
Enkrypt AI. "Anthropic's Slack MCP server leaks data through Slack link unfurling". AIR, AIR-2025-0047. https://agentincident.vercel.app/i/AIR-2025-0047/ (accessed 2026-10-19).