Slack AI leaks private data through a public channel (2024)

The system

Slack AI is Slack's built-in assistant, which answers employee questions by retrieving relevant messages (a RAG search) across the workspace. By Slack's own design, that retrieval includes messages in public channels regardless of whether the asking user has joined those channels; Slack treated this as intended behavior, consistent with "anyone in the workspace can technically search public channels."

What was observed

PromptArmor disclosed in August 2024 that an attacker, without any special access, could post a message in a public channel they control and later cause a completely different user's private data (such as an API key from a private channel) to be exposed through Slack AI's own output, rendered as a clickable markdown link.

Stop and think

1. The attacker never joins the victim's private channel and never interacts with the victim directly. Where does the attacker's content and the victim's private data actually meet?
2. Slack AI's answer contains a markdown link labeled "click here to reauthenticate." What makes that link dangerous, and what does clicking it actually send?
3. Slack called the underlying retrieval behavior "intended." If the behavior is intended, what does that imply about where the fix needs to happen, versus just patching one exploit payload?