Confused Deputies in Slack: Exploiting Agentic AI in Production Environments

Abstract

Enterprise AI assistants are increasingly deployed as Slack‑native agents wired into email, Jira, GitHub, Zoom, and internal knowledge systems. This poster presents the results of a month‑long red‑team engagement against two such production agents—“Saturday” (an IT/security assistant) and DevBot (a developer‑productivity assistant)—revealing systemic security failures in agentic architectures.

The findings include: (1) confused‑deputy tool use, where agents executed actions using over‑privileged service accounts rather than the requesting user’s permissions; (2) context‑confusion attacks, where multi‑user Slack threads caused the agent to leak Gmail and Zoom data belonging to other employees; (3) token‑revocation bypass, where GitHub access persisted even after explicit OAuth disconnection; (4) prompt‑injection‑driven tool misuse, including partial disclosure of service‑account credentials; and (5) a high‑impact phishing amplification attack, where the agent was tricked into posting a fully‑rendered phishing message to an all‑staff Slack channel.