MisbehaviorSerious1 sourceFirst seen
Anthropic's Slack MCP Server Lets Agents Leak Your Secrets Through a Friendly Link Preview
Ourtake
Unfurling was built to be helpful. Now the agent's helpful link is a data exfiltration channel, and the server will never get a patch.
What happened
A security researcher disclosed that Anthropic's deprecated, unmaintained Slack MCP Server does not disable link unfurling, so an AI agent manipulated by prompt injection can post links that leak data such as API keys or channel messages to a third-party server. The vulnerability was reported to Anthropic on May 27, 2025, and Anthropic archived the server on May 29, 2025; it will not be patched and no CVE will be issued.