
Luis Cipriani
7.3K posts

Luis Cipriani
@lfcipriani
CPTO @ https://t.co/KCSSIHQFrc




We got @NotionHQ to leak your private Notion pages 💀 On Thursday @NotionHQ announced Notion 3.0 with support for custom agents using MCP (built by @AnthropicAI) — powerful, but dangerous. @simonw calls these MCP related attacks the “lethal trifecta”: the combination of LLMs, tool access, and persistent memory. Notion’s web-search tool accepts freeform queries as input. With a simple indirect prompt injection we tricked the web search tool into exfiltrating private Notion pages to an attacker controlled server. Now that Notion supports MCPs, prompt injections can come from many sources (GitHub, Jira, email, etc.). Adding AI agents to Notion poses a major security risk all it takes is one prompt injection for private data to leak. Read the writeup: codeintegrity.ai/blog/notion #makewithnotion

















