Abi Raghuram reports that Notion 3.0, released yesterday, introduces new prompt injection data exfiltration vulnerabilities thanks to enabling lethal trifecta attacks. Abi's attack involves a PDF with hidden text (white text on white background) that tricks Notion's agent (in this case using Claude Sonnet 4) into doing the following.
Curated from simonwillison.net · 19 September 2025 →
Notion shipped agents on 18 September 2025 with access to a workspace, the ability to read uploaded files, and a web search tool. That is the lethal trifecta assembled in one product, and CodeIntegrity demonstrated it the next day: a PDF presented as a customer feedback report, carrying white-on-white instructions dressed up as an internal procedure complete with a pre-authorised and safe reassurance. A user uploads it and asks for a summary; the agent reads the client list and sends names, companies and revenue out through the search tool's own network requests. Notion shipped mitigations afterwards. The reason the search tool is the exfiltration path is that it is the one capability whose whole job is to make outbound requests.
