knowyourailive
All cases and studies

Notion AI

Notion · May 2026

Critical · 5 reported findings

Page-style instructions steered Notion AI into returning tool schemas, filesystem-shaped output, and a page-write confirmation.

Disclosed via HackerOne · Free-tier account · duplicate dispute open

The saved conversation records a canary instruction followed by schema and source-like output, then a write confirmation in a researcher-controlled workspace. Researcher-assessed CVSS 9.3.

Indirect Prompt InjectionTool Schema DisclosureSource Code DisclosureWrite Injection

What happened

  1. Instruction following. The assistant included the canary from supplied meeting-note text in its summary.
  2. Full tool schema disclosed. The agent dumped its entire internal function-calling schema, exposing undocumented connections: fs, system, web, skills, helpdocs, search, notion.
  3. Filesystem-shaped response. The assistant returned an entries object naming modules and connections.ts. The screenshot shows the response, not an independently verified filesystem.
  4. Source-like output. The assistant returned TypeScript naming 25+ integration modules, including Salesforce, GitHub, Gmail, Slack, Jira, mcpServer, and test. Production provenance is unverified.
  5. Page-write confirmation. The saved UI shows a marker appended after a target page was attached and a write was requested. The broader report alleges cross-page injection, which requires a matched control and page-history evidence.

Why it matters. The case asks where retrieved content gains authority over tool use. The public captures support the response sequence, while the reported infrastructure and write-scope claims need stronger independent proof.

Disclosure record

  1. Reported via HackerOne (#3756704)
  2. Triage
  3. Write-injection portion marked duplicate

Vendor response. Write-injection closed as duplicate. Dispute open — the chain as reported was not covered by the report it was duplicated against.

Know the limit

Screenshots establish what the assistant returned. Filesystem and source provenance need independent validation. The write capture includes a user-attached target page and an explicit write request, so it does not independently prove an unauthorized cross-page write.

How to prevent this

All work here was performed independently, on personal time, equipment, and accounts, outside and unrelated to any employment. It uses no employer systems, data, or resources and does not represent any employer's views. Public records omit attack payloads and sensitive source material. Full reproduction is available to the affected vendor on request.