What Happened
This living resource aggregates multiple prompt injection and AI agent data‑exfiltration cases, including a Check Point Research discovery of a data exfiltration flaw in ChatGPT’s code execution sandbox where a malicious prompt can trigger DNS tunneling to leak conversation content and uploaded documents to an attacker‑controlled DNS server.[5] It also describes four prompt‑injection‑triggered vulnerabilities in the open‑source CrewAI multi‑agent framework and a PromptArmor‑disclosed unpatched data exfiltration issue in Notion AI that can leak sensitive workspace information, underscoring risks in popular SaaS and collaborative tools.[5]
Why It Matters
The report aggregates multiple prompt-injection and agent data-exfiltration cases, including a Check Point Research disclosure describing a flaw in ChatGPT’s code execution sandbox that could enable DNS tunneling to leak conversation content and uploaded documents. It also cites prompt-injection-triggered vulnerabilities in the open-source CrewAI multi-agent framework and an unpatched Notion AI data-exfiltration issue affecting workspace information. RealGround analysis: this is a high-priority prompt-injection and AI agent abuse risk because the described failures can directly expose sensitive data across popular SaaS and agent workflows.
RealGround Analysis
This signal maps to prompt injection. Organizations using AI agents, LLM APIs, SaaS integrations, or sensitive data workflows should review whether this class of issue could create unauthorized tool execution, data leakage, weak approval gates, or unmanaged supply-chain exposure.
Recommended Actions
- Restrict AI agent tool permissions and production write paths.
- Review sensitive data access across prompts, logs, embeddings, memory, and SaaS integrations.
- Add human approval workflows for high-impact or state-changing actions.
- Run prompt injection and indirect prompt injection tests against affected workflows.
- Document the owner, control gap, and remediation deadline for this risk class.