SLACK AI CAN BE TRICKED INTO LEAKING DATA FROM PRIVATE CHANNELS VIA PROMPT INJECTION

Summary from the TLDR InfoSec newsletter

A method to abuse Slack AI to leak messages from private channels was recently discovered. The prompt injection attack enables attackers to post prompt injection messages in public channels and retrieve API keys from channels that the attackers do not have access to. Slack has stated that this is not a vulnerability and that the feature is working as intended.