🚨 Security Advisory: Anthropic's Slack MCP Server leaks data via link unfurling ☠️ See a demo exploit with Claude Code connected to the MCP server, and how a prompt injection attack can leak developer secrets. Watch and learn!

🛠️ No patch coming! Server is now deprecated and not maintained anymore - but it appears still widely used. MCP ecosystem is extremely immature. If you are using, or hosting the server, read the details and take necessary precautions:

Is this the official slack MCP? You should try this with the cursor slack integration(Background Agent). Its technically a slack app , but maybe your script will expose the same vulnerability.

This is Anthropic's Slack MCP server. It was deprecated two days after I reported the issue, but it can still be downloaded via npm. Over 14k downloads last week. Yeah, it's a quite common bug - seen it in most LLM Slackbots and other messaging bots, so good to raise awareness.

Really nice exploit. Does the C file contain hidden instructions or the .env file? Link unfurling was also the key to our CTF challenge from last summer:

fyi - more lethal trifecta. this time via link unfurling. blog has details

Unfurled links can leak sensitive data. Be careful.

Yes, the general threat applies to any AI agent that posts to a messaging app. I described this behavior here and also looked at most common messaging apps to see what they do with links