Integrations
Security testing for AI agents in Slack
An AI agent installed in Slack acts through the scopes its token holds, such as reading channel history and posting messages. Slack itself warns that an LLM app can be steered by a crafted message into exfiltrating data through links. We test whether your agent can be made to read, post or leak what it should not.
Slack is named here as a surface we test. Names and logos belong to their owners; no customer relationship, partnership or endorsement is implied.
What can an agent do through the Slack API?
Slack apps act through scopes granted at install. The chat:write scope lets an app send messages as itself and is compatible with methods including chat.postMessage, chat.update, chat.delete and chat.scheduleMessage. The channels:history scope lets an app view messages and other content in public channels it has been added to, through conversations.history and conversations.replies.
For an agent, that pairing matters. History is where untrusted text arrives, because anyone who can post in a channel the agent reads can put instructions in front of it. Posting is where data leaves, because a message can carry text, links and formatting chosen by the model.
How do Slack actions get abused?
| Action | Abuse path | Class |
|---|---|---|
| Read channel history | A message in a channel the agent reads carries instructions the agent follows. | Prompt injection |
| Post a message | Injected text makes the agent post earlier messages, or a summary of them, into a channel or DM the attacker can see. | Data exfiltration |
| Post a link | The model builds a URL with conversation data in its query string; unfurling fetches it. | Data exfiltration |
| Update or delete messages | The agent edits or removes messages it posted, including approvals or audit notes. | Unsafe actions |
| User token instead of bot token | The agent acts with a person's access rather than its own narrower access. | Privilege escalation |
Slack's own security best practices describe the link path step by step: an attacker sends a message with a hidden instruction, the LLM builds a URL containing recent channel messages, posts it, and link unfurling makes the request that delivers the data to the attacker's site.
Illustrative trace
Illustrative example, not a real customer finding.
What least-privilege controls does Slack document?
Slack's guidance says every app should hold only the minimum scopes it needs, and suggests a scope policy in which chat:write is low risk while channels:history needs approval. For AI apps it recommends disabling link unfurling by default and explicitly turning it off when posting messages that may contain model-generated URLs, which chat.postMessage supports through its unfurl_links and unfurl_media arguments. It also recommends an allow list for external domains, not responding to messages sent by the LLM itself, and restricting token use to known IP ranges.
Slack is clear that system prompt hardening is not a complete solution. The controls that hold are the ones in your code: which channels the agent reads, which it can post to, and whether model output can carry links at all.
What do we test?
In an Agent Action Pentest we list the scopes and token types your Slack app holds, then plant instructions in channels and threads the agent reads and check which posts, edits and links follow. We try to move content from private conversations into places an outsider can see, and to get URLs with data in them posted with unfurling on. Testing happens in a workspace or channels you set up for the engagement. Related risks: prompt injection, indirect prompt injection, excessive agency and sensitive information disclosure. Agents built on the OpenAI Agents SDK or LangChain reach Slack through tools you write, so the limits belong in those tools.
Agent Action Pentest: $2,500 fixed. Written report within 72 hours of access, or a full refund.
See the offer or email yaz@plaw.io
Questions
Do you need access to our real workspace?
No. A test workspace or dedicated channels with the same app installation and scopes are enough.
Is a bot token safer than a user token?
A bot token acts as the app with the scopes granted to it. A user token acts with that person's access. We check which one the agent holds and what it can reach.
Does disabling unfurling fix prompt injection?
No. It closes one exit Slack describes. The agent can still post data in plain text, so we test the other paths too.
Related pages
- 01Prompt injection in AI agentsInstructions in user input or ingested content override what the agent was told to do.
- 02Indirect prompt injection in AI agentsHidden instructions in emails, pages, files or tool results steer an agent that reads them.
- 04Sensitive information disclosure through agent actionsCustomer data, secrets or system prompts leave through output, links or tool calls.
- 03Excessive agency in AI agentsThe agent holds more tools, permissions or autonomy than the task needs.
- Security testing for AI agents with Gmail accessRead, send, modify and filter scopes for agents that work in a Gmail mailbox.
- Security testing for OpenAI Agents SDK appsFunction tools, handoffs, guardrails and MCP servers in the OpenAI Agents SDK.
- Security testing for LangChain and LangGraph agentsTools, permissions and human-in-the-loop interrupts in LangChain and LangGraph.
Sources
Last reviewed: