AI Data Leaks: Rovo vs Notion AI vs Slack AI vs ClickUp Brain

Quick answer: AI data leaks in work tools happen when an assistant reads hostile text, follows instructions hidden in it, and sends your private data to an outside server through a URL fetch, a rendered image, or a link. Public research has shown this in Atlassian Rovo, Notion AI, and Slack AI. Notion and Slack shipped fixes; we found no public fix for the Rovo path as of 2026-10-27.

Your project management AI reads text you did not write: support tickets, uploaded PDFs, connector pages, public channels. Any of it can carry instructions.

This post compares Rovo, Notion AI, Slack AI, and ClickUp Brain. Every row cites a primary write-up or vendor page, with a date. Where we found nothing, the table says “no public report found”. The same mechanism applies to coding agents, which we cover at the end.

What an AI data leak is, in one sentence

An indirect prompt injection is an instruction hidden inside content an AI assistant processes, which the assistant then follows as if you had asked for it.

It turns into a data leak when three conditions meet. Simon Willison named them the lethal trifecta in June 2025:

1. The assistant can read private data.
2. The assistant reads content an outsider can influence.
3. The assistant has a way to send data out.

Remove any one and the leak path closes. Workspace assistants hold all three by design.

How the Atlassian Rovo exfiltration worked

PromptArmor published its Rovo write-up on 2026-08-05. The chain is short:

1. A user uploads a file, in the demo a “Backlog Guide”, with a hidden instruction inside.
2. The user asks Rovo to organize their Jira tickets.
3. Rovo searches Jira and Confluence, then follows the hidden instruction.
4. Rovo appends ticket and page contents to an attacker URL and opens it with its URL-retrieval tool.
5. The attacker’s server logs the request, data included. The user sees normal output.

No approval step fired. The attack worked with web search turned off, because that toggle does not remove the URL-retrieval tool. Rovo also renders Markdown images, a second channel.

The disclosure timeline matters for buyers. PromptArmor reported on 2026-05-23, Atlassian acknowledged on 05-25, follow-ups on 06-04 and 07-29 went unanswered, and the post went live on 08-05 with Rovo still exposed. The Hacker News thread reached 306 points and 138 comments.

A separate Rovo issue is fixed. The Cloud Security Alliance research note of 2026-08-14 covers Varonis’s one-click “RovoBlast” path through a chat URL parameter, which Atlassian fixed server-side before Varonis published. The same note describes the PromptArmor document path as unresolved. Our search on 2026-10-27 found no later fix announcement.

One naming note: Rovo Dev is Atlassian’s coding agent. It is a different product from the Rovo assistant in this write-up, and the research above does not test it.

Rovo vs Notion AI vs Slack AI vs ClickUp Brain

The table compares what each assistant was shown or documented to do. “Not covered” means the source we read does not address that row.

We left out Linear and Asana. Our search on 2026-10-27 found no public prompt-injection exfiltration report for either assistant, and a missing report is not the same as a clean bill of health.

Notion AI: the edit saved before you approved it

PromptArmor’s Notion AI case hid 1-point white text in a resume. Asked to update a hiring tracker from it, Notion AI built an image URL with the tracker’s text appended. Notion warned about the external URL, but the edit had already saved, so the data left whether the user accepted or not.

Notion validated it after public disclosure and shipped a fix that night. PromptArmor also flagged a similar issue in the Notion Mail drafting assistant; the update we read does not say whether the fix covers Mail.

Slack AI: one click on a reauthenticate link

The attacker posted instructions in a public channel they created. When a user asked Slack AI about a secret in their own private channel, the answer included a “click here to reauthenticate” link with the secret in the URL. One click sent it out.

Slack told PromptArmor on 2024-08-19 that public-channel search is intended behavior. On 2024-08-21 Slack announced a patch for a low-severity phishing scenario; SC Media reported that the advisory did not name PromptArmor or confirm it was the same issue. PromptArmor also noted that Slack AI began ingesting files from channels and DMs that month, a path they did not test.

ClickUp Brain: no public report found

We found no published exfiltration research on ClickUp Brain or Super Agents as of 2026-10-27. ClickUp’s Super Agents page says agents work with implicit and explicit permissions and keep “full audit trails for every action”. A ClickUp blog post on Super Agent workflows says agents inherit user-level permissions and require human approval for critical actions. Those are vendor claims, not test results. ClickUp’s help article on prompt injection returned a bot check to us, so we did not quote it.

Which fix holds, and which only slows an attacker

The Hacker News thread ranked the defenses:

• Fetch only URLs the user typed or a trusted tool returned. Simon Willison argued the agent must not construct a URL at all. Filtering the query string is not enough, since wildcard DNS can carry data in a subdomain.
• Pre-indexed URLs only. The commenter wunderwuzzi23 pointed out that restricting fetches to search-indexed pages still leaks, one character per request.
• Domain allowlists. For an assistant with a narrow job, a short list of allowed outbound domains holds well.
• Classifiers and regex filters. Useful as a layer. Probabilistic, so never the last line.

The common thread: deterministic limits on the outbound channel beat smarter prompts. A model that refuses more often still holds whatever network access you gave it, a point we made about prompt injection and agent guardrails when Claude Opus 5.5 shipped.

What to check before you turn on a workspace AI

Ask the vendor these in writing.

1. Which tools can send data outside the tenant: URL fetch, image rendering, link rendering, email, connectors?
2. Does each related setting remove the tool, or only hide a feature that uses it? Rovo’s web search toggle did the second.
3. Can it fetch a URL the model built itself?
4. Are Markdown images from external domains rendered in AI output?
5. What does it read by default: uploads, connected drives, DMs, public channels?
6. Which actions need a human approval, and does the approval come before the side effect? Notion’s came after.
7. What did the vendor do with its last external report, and how fast?

Use a workspace assistant when its outbound channels are documented and you can switch each one off. Hold off when the vendor cannot list them.

Where Sharkly fits, honestly

Sharkly is not an assistant embedded in your docs, and it is not immune to prompt injection. Sharkly manages coding agents such as Claude Code and Codex, and those agents read untrusted text all day: issue bodies, READMEs, fetched pages. The trifecta applies to them too.

What changes is who owns the boundary. In Sharkly, agents execute on your own Computers through a local service. The Computers docs state that the Computer supplies the files, credentials, network access, and tools a run needs. So egress is yours to restrict: put a Computer behind a domain allowlist and every run on it inherits that limit, whichever agent runs.

A few other boundaries come from the docs:

• Guests see only Spaces they are added to. They do not discover or self-join public Spaces (People and roles).
• Third-party actions need an authorized connector. An automation workflow cannot call an outside app you have not connected.
• Secrets stay out of Skills. The Skills docs say never to store passwords, tokens, or keys in Skill instructions or files.

None of this stops an agent from being talked into a bad action inside the access it holds. It narrows that access and keeps a human acceptance step on the Task. Our posts on coding agent permissions and approval gates cover where to draw those lines.

Conclusion

Prompt injection is unsolved in every product that reads untrusted text, coding agents included. The useful question is narrower: what can the assistant send out, and can you switch it off? Of the four tools here, two had public leaks and shipped fixes, one had a public leak with no fix we could find, and one has no public report.

If you run several coding agents and want them on hosts whose network you control, connect one Computer to Sharkly, lock its egress down, and assign an Agent one low-risk Task. Sharkly is currently free for organizations of up to 5 people.

FAQ

Is Atlassian Rovo still vulnerable to data exfiltration?

The PromptArmor document path was unpatched on 2026-08-05, and we found no public fix as of 2026-10-27. The separate Varonis link issue was fixed.

Did Notion fix the Notion AI data leak?

Yes. Notion said its remediation for insecure AI document updates was in production on 2026-01-07, the night PromptArmor disclosed it publicly.

Was the Slack AI prompt injection patched?

Slack announced a patch on 2024-08-21, without confirming it was the exact issue PromptArmor reported.

Does turning off web search stop an AI assistant from leaking data?

Not always. In Rovo’s case the web search setting did not remove the URL-retrieval tool, so the leak still worked.

What is the lethal trifecta in AI security?

Private data, untrusted content, and a way to send data out. An assistant with all three can be steered into a leak.

Can coding agents leak data the same way?

Yes. A coding agent that reads a hostile README and has network access faces the same risk. Limit its credentials and outbound network at the host level.