Executive Summary
An aggregator lists prompt-injection cases including a ChatGPT code-sandbox flaw leaking conversations and documents via DNS tunneling, four CrewAI vulnerabilities and an unpatched Notion AI data exfiltration issue.
What Happened
This living resource aggregates multiple prompt injection and AI agent data‑exfiltration cases, including a Check Point Research discovery of a data exfiltration flaw in ChatGPT’s code execution sandbox where a malicious prompt can trigger DNS tunneling to leak conversation content and uploaded documents to an attacker‑controlled DNS server.[5] It also describes four prompt‑injection‑triggered vulnerabilities in the open‑source CrewAI multi‑agent framework and a PromptArmor‑disclosed unpatched data exfiltration issue in Notion AI that can leak sensitive workspace information, underscoring risks in popular SaaS and collaborative tools.[5]
Affected Products
- OpenAI ChatGPT
- CrewAI
- Notion AI
Vulnerability / Attack Technique
Prompt injection leading to data exfiltration
Technical Mechanism
In ChatGPT, a malicious prompt triggered DNS tunneling from the code sandbox; in CrewAI and Notion AI, injected instructions caused data disclosure.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
DNS is an easily overlooked exfiltration channel from sandboxes. RealGround analysis: AI code sandboxes should have no outbound DNS or network access by default.
Recommended Controls
- Block outbound DNS and network from AI code sandboxes
- Patch CrewAI
- Limit Notion AI access to sensitive workspaces until fixed
Related RealGround Service
AI Red Teaming · or start with the free AI Agent Security Scanner.
Sources
PromptInjection.wtf (aggregating multiple vendor disclosures): https://promptinjection.wtf/
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.