> We responsibly disclosed this vulnerability to Notion via HackerOne. Unfortunately, they said “we're closing this finding as `Not Applicable`”.
Notion AI: Unpatched data exfiltration
21–30 of 42 posts
Re: Notion AI: Unpatched data exfiltration
#22This, of course, more yelling into the void from decades ago, but companies who promise or imply "safety around your data" and fail should be proportionally punished, and we as a society have not yet effectively figured out how to do that yet. Not sure what it will take.
Its perfectly figured out, people just refuse to implement the solution. Stop giving your resources to the bad actors. The horrible behavior so many enable in order to not be inconvenienced is immense.
Re: Notion AI: Unpatched data exfiltration
#23> We responsibly disclosed this vulnerability to Notion via HackerOne. Unfortunately, they said “we're closing this finding as `Not Applicable`”.
As much as I love using Notion, they have a terrible track record when it comes to dealing with and responding to security issues.
Re: Notion AI: Unpatched data exfiltration
#24This is @simonw’s Lethal Trifecta [1] again - access to private data and untrusted input are arguably the purpose of enterprise agents, so any external communication is unsafe. Markdown images are just the ones people usually forget about [1] https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/
Good point around the markdown image as an untrusted vector.
Lethal trifecta is determnistically preventable, it really should be addressed wider in the indutry
Re: Notion AI: Unpatched data exfiltration
#25Securing LLMs is just structurally different. The attack space is "the entirety of the human written language" which is effectively infinite. Wrapping your head around this is something we're only now starting to appreciate. In general, treating LLM outputs (no matter where) as untrusted, and ensuring classic cybersecurity guardrails (sandboxing, data permissioning, logging) is the current SOTA on mitigation. It'll b…
As multi-step reasoning and tool use expand, they effectively become distinct actors in the threat model. We have no idea how many different ways the alignment of models can be influenced by the context (the anthropic paper on subliminal learning [1] was a bit eye opening in this regard) and subsequently have no deterministic way to protect it.
1 - https://alignment.anthropic.com/2025/subliminal-learning/
Re: Notion AI: Unpatched data exfiltration
#26Wow what a coincidence. I just migrated from notion to obsidian today. Looks like I timed it perfectly (or maybe slightly too late?)
How was the migration process? I work on a plugin that makes Obsidian real-time collaborative (relay.md), so if the migration is smooth I wonder how close we are to Obsidian being a suitable Notion replacement for small teams.
I've been waiting for Logseq DB to come out to replace Google docs for my team. So your offering is interesting, but
1) is it possible to use Obsidian like Logseq, with a primary block based system (the block based system, which allows building documents like Lego bricks, and easily cross referencing sections of other documents is key to me) and
2) Don't you expect to be sherlocked by the obsidian team?
Re: Notion AI: Unpatched data exfiltration
#27Earlier quoted context omitted.
It's pretty simple, don't give llms access to anything that you can't afford to expose. You treat the llm as if it was the user.
I get that but just not entirely obvious how you do that for the Notion AI.
Don't use AI/LLMs that have unfettered access to everything?
Feels like the question is "How do I prevent unauthenticated and anonymous users to use my endpoint that doesn't have any authentication and is on the public internet?", which is the wrong question.
Re: Notion AI: Unpatched data exfiltration
#28Earlier quoted context omitted.
How was the migration process? I work on a plugin that makes Obsidian real-time collaborative (relay.md), so if the migration is smooth I wonder how close we are to Obsidian being a suitable Notion replacement for small teams.
I've been waiting for Logseq DB to come out to replace Google docs for my team. So your offering is interesting, but 1) is it possible to use Obsidian like Logseq, with a primary block based system (the block based system, which allows building documents like Lego bricks, and easily cross referencing sections of other documents is key to me) and 2) Don't you expect to be sherlocked by the obsidian team?
> 1) is it possible to use Obsidian like Logseq, with a primary block based system (the block based system, which allows building documents like Lego bricks, and easily cross referencing sections of other documents is key to me) and
More or less yes, embeddable templates basically gives you that out of the box, Obsidian "Bases" let you query them.
> 2) Don't you expect to be sherlocked by the obsidian team?
I seem to remember that someone from the team once said they have no interest in building "real-time" collaboration features, but I might misremember and I cannot find it now.
And after all, Obsidian is a for-profit company who can change their mind, so as long as you don't try to build your own for-profit business on top of a use case that could be sherlocked, I think they're fine.
Re: Notion AI: Unpatched data exfiltration
#29IMHO the problem really comes from the browser accessing the URL without explicit user permission. Bring back desktop software.
Meh, bring back thinking of security regardless of the platform instead. The web is gonna stay, might as well wish for people to treat the security on the platform better.
Re: Notion AI: Unpatched data exfiltration
#30One more reason not to use Notion. I wonder when there will be awakening to not use SaaS for everything you do. And the sad thing is that this is the behavior of supposedly tech-savvy people in places like the bay area. I think the next wave is going to be native apps, with a single purchase model - the way things used to be. AI is going to enable devs, even indie devs, to make such products.
> I think the next wave is going to be native apps
elaborate please?