Case notion-agent-pdf-exfilPrompt injectionUnited States
Notion 3.0 agents tricked by white-text PDF into leaking client data via web search
CodeIntegrity's Abi Raghuram showed a PDF with hidden white text could make a Notion agent collect client names, companies and ARR and pass them in a URL to its web search tool. Notion added detection and link approvals.
MediumAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Sep 19, 2025
- Location
- United States
- Target
- Notion AI agents (Notion 3.0)
- Severity
- Medium
- Triggered by
- Abi Raghuram (CodeIntegrity)
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
CodeIntegrity's Abi Raghuram showed a PDF with hidden white text could make a Notion agent collect client names, companies and ARR and pass them in a URL to its web search tool. Notion added detection and link approvals.
Impact: Any user summarising a malicious PDF could leak workspace data; no real victims reported
Who triggered it
Actor: Abi Raghuram (CodeIntegrity)
Attribution: Public proof of concept; Notion responded with product changes
Motive: Security research
How it happened
Attack vector: Indirect prompt injection in an uploaded PDF; agent's search tool accepted arbitrary URLs so exfiltration rode on a legitimate function call
Root cause: Agent combined private workspace access, untrusted file content and an outbound web tool without link approval
Timeline
- Notion 3.0 agents launch
- CodeIntegrity publishes the exfiltration demo
- Notion announces broader injection detection, link approval prompts and admin control to disable web access
Response
Notion upgraded injection detection for attachments, required approval of model-generated links and let admins disable agent web access
Current status: Patched
Sources (open in a new tab)
- Simon Willison simonwillison.net
- The Decoder the-decoder.com
- Schneier on Security schneier.com
Cite this case
Notion 3.0 agents tricked by white-text PDF into leaking client data via web search. AI Threat Watch, case notion-agent-pdf-exfil, Sep 19, 2025. https://aithreat.io/cases/notion-agent-pdf-exfil/
Permanent link: https://aithreat.io/cases/notion-agent-pdf-exfil/