Disclosed vulnerability
Ramp Sheets AI: hidden white-on-white injection makes the agent auto-insert an IMAGE() formula that leaks company financials
AIR-2026-0046 AIR record · 2026-02-ramp-sheets-ai-exfiltrates-financials
From the supporting source
Ramp AI is manipulated into building an IMAGE formula that uses an attacker's URL and appends the victim's sensitive data to the end of the link.promptarmor.com
The record
Disclosed
2026-02-19
Vendor
Ramp
Product
Ramp Sheets AI
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — the agent auto-inserted an IMAGE() formula that fetched the attacker URL
Attack surface
Enterprise assistant
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection spreadsheet hidden text
Impact type
Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Ramp Sheets AI users importing externally sourced datasets
Capability abused
Defense & remediation
Recorded defense
none effective; formulas inserted without user approval
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
resolved 2026-03-16
Taxonomy & references
Curator notes
PromptArmor. Same IMAGE()-formula exfiltration class as CellShock (Claude for Excel) but against a fintech spreadsheet agent. Disclosed 2026-02-19, resolved by Ramp 2026-03-16.
Cite as
Enkrypt AI. "Ramp Sheets AI: hidden white-on-white injection makes the agent auto-insert an IMAGE() formula that leaks company financials". AIR, AIR-2026-0046. https://agentincident.vercel.app/i/AIR-2026-0046/ (accessed 2026-10-19).