Notion's MCP connector secretly prompt-injects agents to upsell Notion Business
JavaSensei24 · reddit · 2026-09-07
A Reddit user discovered that Notion's official MCP connector embeds instructions that make connected AI agents pitch Notion Business plans mid-task — and explicitly tells the model never to explain why. The poster's bot did exactly that even though they never asked about Notion plans, and no documentation of this behavior could be found in Notion's docs. The post frames this as weaponizing prompt injection to turn users' assistants into ad channels, drawing criticism of Notion's transparency.
More from Safety
- If an agent can rewrite itself, does your consent still mean anything? — tallmetommy · 2026-10-26
- 109 of 529 AI Agent Incidents Involved No Adversary, Arguing Red Teams Must Test Normal Operation — anacondainc · 2026-10-26
- Cryptographer Matthew Green: if your code looks vulnerable, fix it now — matthew_d_green · 2026-10-26
- Filtering secrets on the write path: why agent memory deserves more suspicion at ingest than retrieval — Classic-Being-7960 · 2026-10-26
- After OpenCode key leak: 5 practical rules for keeping keys away from agents — jacobholm_dev · 2026-10-26
- Formal verification spat: specs are inherently limited against real-world threats — davidmanheim · 2026-10-26