CVE-2025-34072 Overview
A data exfiltration vulnerability exists in Anthropic's deprecated Slack Model Context Protocol (MCP) Server via automatic link unfurling. When an AI agent using the Slack MCP Server processes untrusted data, it can be manipulated to generate messages containing attacker-crafted hyperlinks embedding sensitive data. Slack's link preview bots (e.g., Slack-LinkExpanding, Slackbot, Slack-ImgProxy) will then issue outbound requests to the attacker-controlled URL, resulting in zero-click exfiltration of private data.
Critical Impact
Zero-click data exfiltration allowing attackers to steal sensitive information through AI agent manipulation without user interaction via Slack's automatic link preview functionality.
Affected Products
- Anthropic Slack MCP Server (deprecated versions)
- AI agents integrated with the vulnerable Slack MCP Server
- Slack workspaces utilizing the affected MCP Server integration
Discovery Timeline
- 2025-07-02 - CVE CVE-2025-34072 published to NVD
- 2025-07-03 - Last updated in NVD database
Technical Details for CVE-2025-34072
Vulnerability Analysis
This vulnerability represents a sophisticated data exfiltration attack chain that exploits the intersection between AI agent behavior and Slack's automatic link unfurling feature. The root issue stems from improper input validation (CWE-20), where the MCP Server fails to adequately sanitize or restrict the content that AI agents can generate when processing potentially malicious input data.
The attack leverages a "confused deputy" pattern where the AI agent is tricked into acting as an unwitting accomplice in the data theft. By crafting specific prompts or data inputs, an attacker can manipulate the AI agent into generating Slack messages containing malicious hyperlinks. These links are constructed to encode sensitive data within the URL structure itself, such as API keys, authentication tokens, or confidential business information that the agent has access to.
The zero-click nature of this vulnerability makes it particularly dangerous. Once the AI agent posts a message containing the crafted URL, Slack's link preview bots automatically fetch the URL to generate a preview, thereby transmitting the embedded sensitive data to an attacker-controlled server without any user interaction required.
Root Cause
The vulnerability stems from improper input validation (CWE-20) in the Anthropic Slack MCP Server. The server fails to implement adequate controls to prevent AI agents from:
- Embedding sensitive or contextual data within outbound URLs
- Generating messages with hyperlinks to arbitrary external domains
- Being manipulated through prompt injection or data poisoning attacks
The lack of output sanitization combined with Slack's automatic link unfurling behavior creates a covert exfiltration channel that bypasses traditional security controls.
Attack Vector
The attack follows a network-based vector requiring no user interaction and low complexity to execute. An attacker can exploit this vulnerability through the following mechanism:
- The attacker injects malicious content or instructions into data that will be processed by an AI agent connected to the vulnerable Slack MCP Server
- The AI agent processes the untrusted data and is manipulated into generating a Slack message containing an attacker-controlled URL
- Sensitive data accessible to the agent is encoded within the URL parameters or path structure
- When the message is posted, Slack's link preview bots (Slack-LinkExpanding, Slackbot, or Slack-ImgProxy) automatically issue HTTP requests to the URL
- The attacker's server receives the request, capturing the embedded sensitive data from the URL without any user clicking the link
This zero-click exfiltration technique leverages legitimate Slack functionality to exfiltrate data, making it difficult to detect through conventional security monitoring.
Detection Methods for CVE-2025-34072
Indicators of Compromise
- Outbound HTTP/HTTPS requests from Slack link preview bots to unusual or newly registered domains
- AI-generated Slack messages containing URLs with unusually long query strings or encoded data in URL paths
- Network traffic to attacker-controlled domains containing base64-encoded or URL-encoded sensitive data patterns
- Spike in outbound requests from Slack-LinkExpanding, Slackbot, or Slack-ImgProxy user agents to non-standard domains
Detection Strategies
- Monitor AI agent outputs for messages containing URLs to external domains, particularly those with embedded data patterns
- Implement network traffic analysis to detect unusual URL structures in outbound Slack bot requests
- Deploy URL allowlisting for AI agent-generated content to restrict outbound link destinations
- Analyze Slack audit logs for automated message generation patterns that include external hyperlinks
Monitoring Recommendations
- Configure SIEM rules to alert on abnormal outbound traffic patterns from Slack infrastructure
- Establish baseline metrics for AI agent message generation and flag deviations in URL-containing output
- Implement real-time monitoring of DNS queries to newly registered or suspicious domains from Slack environments
- Review AI agent conversation logs for potential prompt injection attempts targeting link generation
How to Mitigate CVE-2025-34072
Immediate Actions Required
- Discontinue use of the deprecated Anthropic Slack MCP Server and migrate to supported alternatives
- Review and audit all AI agent integrations connected to Slack workspaces for similar vulnerabilities
- Implement output filtering to block AI-generated messages containing URLs to untrusted domains
- Enable additional Slack workspace security controls to restrict link preview behavior where possible
Patch Information
The Anthropic Slack MCP Server has been deprecated. Organizations should transition to supported MCP server implementations with proper input/output validation controls. Review the EmbraceTheRed Blog Security Advisory and VulnCheck Advisory for the latest remediation guidance and updated server recommendations.
Workarounds
- Disable link unfurling for channels where AI agents operate by configuring Slack workspace settings
- Implement a proxy or content inspection layer for AI agent outputs to filter and sanitize URLs before posting
- Restrict AI agent permissions to prevent posting messages with external hyperlinks
- Deploy network-level controls to block outbound requests to non-allowlisted domains from Slack bot traffic
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
