AI agents leak sensitive data via messaging app link previews
Security researchers at PromptArmor have documented a zero-click prompt injection vulnerability that allows attackers to trick AI agents in messaging platforms into leaking sensitive data through automatic link preview features. The attack exploits trusted system processes in apps like Microsoft Teams, Slack, Discord, Telegram, and Apple to exfiltrate information such as API keys and logs.
What happened
Security researchers at PromptArmor demonstrated a zero-click prompt injection attack that tricks AI agents integrated into messaging platforms into exfiltrating sensitive data through automatic link preview features.
The attack works by embedding malicious instructions within data that the AI processes, causing the agent to generate a URL containing sensitive information such as API keys or logs. When the AI posts this link in chat, the messaging app automatically fetches the URL to generate a preview, delivering the sensitive data to an attacker-controlled server.
Reported impact
The vulnerability is described as systemic rather than isolated to a single bot, affecting configurations including Microsoft Teams running Copilot Studio and Slack utilizing specific bots.
Index analysis
The attack exploits the implicit trust messaging platforms place in URLs generated within their ecosystem. Because the link preview mechanism functions as a trusted system process, it bypasses standard user-level security checks.
Governance controls
PromptArmor suggests the responsibility for addressing the vulnerability lies with organizations deploying AI agents with increasing autonomy and access to sensitive data stores.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.