安全公告：Anthropic 的 Slack MCP Server 存在数据外泄漏洞

This is a security advisory for a data leakage and exfiltration vulnerability in a popular, but now deprecated and unmaintained, Slack MCP Server from Anthropic.

If you are using this MCP server, or run an “MCP Store” that hosts it, it is advised that you analyze how this threat applies to your use case and apply a patch as needed.

Anthropic’s Slack MCP Server

When Anthropic introduced MCP they published reference server implementations on Github.

One of the reference servers is a Slack MCP Server that is vulnerable to “link unfurling”. We previously described this vulnerability generically for AI agents that post to messaging apps.

At a glance it allows an AI agent that posts to Slack or other messaging applications to leak data to third-party servers. Many chat and messenger applications automatically connect to hyperlinks in order to display a preview of the page.

Why an Advisory?

The reason for publishing this advisory is that Anthropic deprecated many of their MCP servers a few weeks ago, and there is no plan to address security vulnerabilities in them.

Here is the security policy update for the now unmaintained servers:

The server appears widely used. For instance, the recent weekly download count is at 14k+, so there are potentially tens of thousands of vulnerable installations.

Anyone using this MCP server might be impacted and depending on setup susceptible to data leakage.

The Lethal Trifecta

We have seen many 0-click data exfiltration vulnerabilities in AI apps and agents over the last 2+ years, and they keep showing up.

Recently, Simon Willison gave this common threat a great name, the lethal trifecta.

In this case the severity can be high if an AI agent:

Uses the Anthropic Slack MCP server; Has access to private data; Processes untrusted data (documents, web pages, messages,…)

When posting to channels, Anthropic’s Slack MCP server does not disable unfurling of hyperlinks. This can have unwanted side effects, including leaking of information by an AI agent. An attacker can exploit this via a prompt injection attack.

In case you are looking for a quick explanation, here is an end-to-end illustration that leverages invisible prompt injection to exfiltrate an API key from a developer’s .env file.

These are the steps to understand the scenario:

Developer analyzes a malicious source code file with Claude Code; Invisible prompt injection in the source code takes control of the agent; Attack retrieves .env file and posts a link to Slack including secrets from the file; Due to link unfurling being enabled the information is exfiltrated to the attacker

The data is actually leaked multiple times, e.g. if you use an image link there are multiple requests via Slack-LinkExpanding, Slackbot 1.0 and Slack-ImgProxy.

Reminder: Anthropic models interpret invisible Unicode Tag characters as instructions but it is not seen as a security vulnerability by Anthropic as we have discussed in the past. This is another example where it has security impact in my opinion, however invisible instructions is not the focus of this post.

For a more detailed explanation, other threat vectors and how to mitigate it keep reading.

One of the improvements we have seen over the last two years is that most, still not all, AI systems by default prompt the user for confirmation before invoking tools, including MCP tools.

Many users are likely enabling unsupervised tool usage over time. I call this the normalization of deviance in AI systems. It reflects an increasing and often unwarranted overreliance on model output.

In this specific case with Slack, it might appear safe and secure to allow unsupervised posting. For example, consider the MCP server is configured to only have permission to post to a single private Slack channel. No other channel! This is actually possible with this MCP server.

Breaking The Security Boundary

Now, users and developers might incorrectly assume that it is safe to invoke the post message tool, even unsupervised, because there should be no threat of data exfiltration or other side effects besides messages showing up in that private channel.

However, the unfurling (crawling) of hyperlinks breaks this security boundary. The AI agent can post and leak data outside an organization to a third-party server. An attacker can exploit it via prompt injection from untrusted data.

The code can now be found here. As mentioned this code is no longer maintained by Anthropic.

Leakage Scenario Walkthrough

Let’s walk through another example, this time with Claude Desktop.

First, for demo purposes we need some data to leak. To keep things simple, this is the last message in the “matrix” channel that we will grab and leak:

This could be any other info, also from other MCP servers or conversation history, etc…

Now, let’s simulate the attack. The user analyzes a document, and uses the MCP server to post a summary to their team.

This document contained a prompt injection that asks to read information from the “matrix” channel, and then post a hyperlink containing the last message to a private Slack channel called “private-teams-discussion”.

The prompt injection payload looked like this:

That’s it. This prompt injection can occur via many means, the document is just one example.

Now the AI agent posted a message to the private Slack channel containing the crafted hyperlink with “The code is Trust No AI!” appended:

Due to link unfurling the attacker’s web server received the Slackbot-Link-Expanding request, including the query parameter with the leaked data:

Video Walkthrough

To see the demos in action for both Claude Code and Claude Desktop, and also learn a bit more about MCP and how to configure permissions and settings in Claude Desktop, check out this video.

Responsible Disclosure

This vulnerability was reported to Anthropic on May 27th, 2025, and Anthropic archived the MCP server on May 29, 2025. It’s unclear if the two events are related.

However, this means the server, although potentially widely deployed and used it will not be patched.

After further discussion, Anthropic shared that they are okay with public disclosure. Hence, sharing this information to raise awareness that users and enterprises can take steps to protect themselves.

Also, Anthropic will not publish a CVE as far as I can tell.

CVSS Severity Score per AI

I was curious to see how various AIs would calculate the CVSS score for this one.

Here are the responses:

ChatGPT: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N 9.1 Critical; Grok: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:X/RL:U/RC:C 9.3 Critical; Claude: Claude is unable to respond to this request. Please start a new chat; Gemini: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N 8.7 High

Interestingly, I scored it as 7.5 High severity.

Mitigating The Vulnerability

First, it’s probably best to always only use servers that are from the vendors of a specific product. This ensures long-term support, including security patches. So, use this server at your own risk.

A possible patch is to add these two lines to the post and reply message functions - this disables link unfurling for links and media (like images). The Slack documentation is here.

See the appendix for details.

Now, when testing unfurling is not happening anymore.

Does Everyone Need To Patch?

It depends on your threat model and risk appetite. The safe and secure option is to disable all link unfurling by default. Worst case scenario is the leakage of sensitive info of internal company data and secrets.

I could see some using the MCP server in CI/CD pipelines. The risk increases if an adversary has insights on how to invoke the server and where to plant the prompt injection payload.

Further Improvements

A more granular approach would be to add a feature for allow-listing of domains, to provide more config options via the configuration parameters. But by default link unfurling should always be off for any kind of AI or MCP server that posts to Slack or other messaging applications.

Slack App Configuration

Also review the Slack app’s permissions to ensure a least privilege configuration and minimize potential exposure.

Conclusion

Claude Desktop, Claude Code, Windsurf, VS Code, or any AI system that is configured to use the Slack MCP Server from Anthropic is susceptible to data exfiltration when posting messages. An adversary can exploit this via prompt injection to leak sensitive information.

This post highlights one of the emerging challenges across the industry, especially when it comes to enterprise adoption of AI. Many enterprises probably have to clean this one up now. A good reminder to inventory who installed and uses MCP servers across organizations…

This code change seems to fix the issue:

Recent Weekly Download Count on npmjs

ASCII Smuggling Demo

References

Simon Willison - The lethal trifecta; Commit on May 29 2025 that archived MCP servers; Location of now archived MCP Server; Security Policy Update For Unmaintained MCP Servers; The Dangers of Unfurling Links; Threats to Chatbots; Slack - Link Unfurling

Newer →; Contact me; ← Older