Disclosed vulnerability
Databricks Genie: malicious Skills bridge compute and display controls to exfiltrate datasets and render phishing overlays
AIR-2026-0270 AIR record · 2026-10-databricks-genie-malicious-skills-exfiltration
From the supporting source
The controls to prevent exfiltration were technically upheld, but exfiltration succeeded nonetheless.promptarmor.com
The record
Disclosed
2026-10-05
Vendor
Databricks
Product
Databricks Genie Code
Risk domain
Privacy › Data exfiltration channels
Also touches
Human manipulation, Supply chain vulnerabilities
System type
Generative model
Who acted
Agent acted (contested) — Genie executes the skill, queries tenant data and constructs a malicious display; user viewing triggers the final browser transmission
Attack surface
Skill / plugin
Autonomy level
Semi-autonomous
Initial vector
Malicious uploaded skill
Impact type
Data exfiltration, Phishing
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Genie Code users who load a malicious Skill from their personal workspace
Capability abused
Defense & remediation
Recorded defense
Guardrail agent (auto-approve mode), coding-environment egress controls, display sandbox
Guardrail kinds
Human approval, Sandbox isolation, Permission scope
Guardrail outcome
Silent
Taxonomy & references
Curator notes
PromptArmor; reported to Databricks on 16 Aug 2026 and published 5 Oct. A malicious Skill loaded from the user's personal workspace (not the governed catalog) passed the guardrail agent, queried tenant data and built it into an HTML display. Viewing the results showed a credential-phishing overlay and sent the data out from the user's browser, which the coding environment's egress controls do not cover. Researcher demonstration; no victims reported. Databricks says malicious uploaded Skills are the user's responsibility and that auto-approve is not a security boundary. No fix.
Supporting sources
Cite as
Enkrypt AI. "Databricks Genie: malicious Skills bridge compute and display controls to exfiltrate datasets and render phishing overlays". AIR, AIR-2026-0270. https://agentincident.vercel.app/i/AIR-2026-0270/ (accessed 2026-10-19).