“An attacker can prompt Slack AI to exfil data from private channels where the attacker (malicious prompt author) isn’t a member, by posting in a public channel.”
One planted message in a one-member public channel turns Slack AI into a courier for API keys sitting in someone else’s private channel. Slack reviewed the report and called the evidence insufficient. Its answer was that public messages being searchable is intended behavior. On August 14 Slack AI started ingesting uploaded documents and Google Drive files too, so the attack surface grew the same week Slack waved this off.