Slack AI could be tricked into revealing login credentials and more

Security researchers claim to have discovered a way to trick Slack's AI assistant into sharing confidential information and other secrets with unauthorized users

Slack, used by more than 35 million people worldwide, launched its own artificial intelligence (AI) tool in September 2023, allowing users to summarize multiple unread messages, answer various questions, search for files, and more.

But as we've seen with other chatbots in the past, a malicious actor could use a carefully crafted prompt (a command sent to the AI) to force the tool to reveal sensitive data from private Slack channels that they're not a member of.

“Intended behavior”

For example, security firm PromptArmor, which discovered the vulnerability and reported it to Salesforce, explained how fraudsters could steal API keys:

“We demonstrate how this behavior allows an attacker to exfiltrate API keys that a developer has placed in a private channel (to which the attacker does not have access).”

The attack involves creating a public Slack channel and entering a malicious prompt that the AI reads. It then instructs the Large Language Model (LLM) to respond to requests for the API key by providing a clickable URL. Clicking the URL sends the API key data to the attacker-controlled website where it can be retrieved.

Apart from API keys, fraudsters could also abuse this vulnerability to steal files uploaded to Slack, as the AI reads them as well.

Furthermore, since the AI also reads files, the hackers don't even need to be part of the Slack workspace to steal secrets. They just need to hide the malicious prompt in a document and trick a workspace member into uploading it (for example, using social engineering).

“If a user downloads a PDF containing one of these malicious instructions (e.g. hidden in white text) and subsequently uploads it to Slack, the same downstream effects of the attack chain can be achieved,” PromptArmor said.

Salesforce, which owns Slack, appears to have fixed the bug for private channels. Public channels, on the other hand, appear to remain vulnerable. According to PromptArmor, Salesforce has said that “messages posted in public channels can be searched and viewed by all members of the workspace, regardless of whether they have joined the channel or not. This is intended behavior.”

Over The Register

Slack AI could be tricked into revealing login credentials and more

You may also like...

Recent Posts

Slack AI could be tricked into revealing login credentials and more

You may also like...

Arrest made in connection with overdose death of Matthew Perry – NBC Los Angeles

Boston Red Sox vs Tampa Bay Rays: Odds, Tips and Predictions

After the shooting in Georgia, dozens of children are threatened and arrested in schools

Recent Posts