fix(security): tag untrusted senders in Slack threads - #10035
Closed
AntAISecurityLab wants to merge 1 commit into
Closed
fix(security): tag untrusted senders in Slack threads#10035AntAISecurityLab wants to merge 1 commit into
AntAISecurityLab wants to merge 1 commit into
Conversation
Label messages from non-allowlisted users with [Message from untrusted user] prefix in thread context, preventing indirect prompt injection via thread replies from unauthorized users.
alt-glitch
added
type/security
1 task
syahidfrd
added a commit
to syahidfrd/hermes-agent
that referenced
this pull request
Jun 17, 2026
When the bot is mentioned mid-thread for the first time,
SlackAdapter._fetch_thread_context() pulls the entire thread via
conversations.replies and prepends every reply to the LLM prompt.
Replies from senders not on the allowlist were rendered identically
to authorised senders, allowing a third party in a shared channel to
inject instructions/questions that the LLM might act on when
answering the next authorised message (CWE-863).
This change:
* Adds set_authorization_check on BasePlatformAdapter, registered
by GatewayRunner with a closure over the existing
_is_user_authorized chain — platform/global allowlists, group
allowlists, allow-all flags, and the pairing store all stay the
single source of truth (no env-var re-parsing in adapters).
* Tags each non-bot thread message whose sender fails the auth
check with an [untrusted] prefix.
* Strengthens the thread-context header with explicit guidance to
the LLM not to follow instructions or answer questions from
[untrusted] messages, but only when at least one is present, so
setups without an allowlist see no behaviour change.
An alternative implementation in NousResearch#10035 fixes the same issue but
re-parses SLACK_ALLOWED_USERS / *_ALLOW_ALL_USERS directly inside
the adapter, missing the pairing store (paired DM users would be
mis-tagged) and the global GATEWAY_ALLOWED_USERS allowlist. Reusing
_is_user_authorized keeps the auth surface consistent.
How to test:
* pytest tests/gateway/test_slack.py::TestThreadContextUntrustedTagging -v
* Configure SLACK_ALLOWED_USERS with a single user ID, post a
message in a thread from another user, then mention the bot
from the allowlisted user. Verify the LLM does not act on the
other user's message.
Contributor
|
Fixed on main via #55979 (commit 0198713), which addresses the same indirect prompt-injection vector. Both PRs tag non-allowlisted senders in Slack thread context. Yours was submitted first — thank you. #55979 was chosen because it routes through the existing Greatly appreciate the report and the fix. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Fix indirect prompt injection vulnerability (CWE-863, MEDIUM) in Slack thread context.
_fetch_thread_context()includes all non-bot thread replies as context for the LLMwithout distinguishing between authorized and unauthorized senders. An unauthorized user
can post crafted messages in a public thread to inject instructions into the LLM context,
potentially manipulating the bot's behavior for authorized users in the same thread.
This PR labels messages from non-allowlisted users with
[Message from untrusted user]prefix in thread context, preserving thread functionality while making the trust boundary
visible to the LLM.
Related Issue
N/A
Type of Change
Changes Made
SlackAdapter._fetch_thread_context()ingateway/platforms/slack.py— checks
SLACK_ALLOW_ALL_USERS,GATEWAY_ALLOW_ALL_USERS, andSLACK_ALLOWED_USERSenv vars, consistent with existing auth patterns in the adapter.
[Message from untrusted user]prefix.How to Test
pytest tests/ -q— all existing tests passSLACK_ALLOWED_USERSwith specific user IDs[Message from untrusted user]prefix