coderinsanSecurity researcher, CodeIntegrityCodeIntegrity
Security test. Notion 3.0 agents with web search, September 2025.
Hacker News, published Read the write-up (opens Hacker News in a new tab)
Observation
A day after Notion 3.0 shipped agents, CodeIntegrity got Notion AI to leak private page data from one booby-trapped PDF.
- Takeaway
- Before agents with web search read uploaded files, decide which workspaces they may touch, and test them with a planted document.
- What happened
- On September 19, 2025, the day after Notion 3.0 shipped agents, the CodeIntegrity team showed that a PDF with hidden instructions could make Notion AI send private Notion page data out through its web search tool when a test user asked it to summarize the PDF, an indirect prompt injection. The report frames the attack with Simon Willison's lethal trifecta: private data, untrusted content and outside communication in one agent.
- Public practitioner write-up (the researchers' own Hacker News post)
- Reproduced by the researchers
Deployment details
Security test. Notion 3.0 agents with web search, September 2025.
- Public practitioner write-up (the researchers' own Hacker News post)
- Reproduced by the researchers
- Team
- Security researchers
- Workload
- Summarizing an uploaded PDF with Notion AI agents
- Product version
- Notion 3.0 agents with web search






