Ramp Fixes AI Spreadsheet Data Exfiltration Flaw

PromptArmor identified a vulnerability in Ramp's Sheets AI that allowed for the exfiltration of sensitive financial data through indirect prompt injection. Attackers could hide malicious instructions in external files to trick the AI into inserting data-stealing formulas without user consent. Ramp has since resolved the issue following a responsible disclosure and a brief remediation period.

Key Points

• Ramp's Sheets AI was susceptible to indirect prompt injection via hidden text in external datasets.
• The vulnerability allowed the AI to automatically insert malicious formulas that triggered external network requests without user approval.
• Attackers could exfiltrate sensitive financial data by appending it to URLs within these formulas.
• The issue mirrors a previously identified vulnerability in Claude for Excel, highlighting a recurring risk in agentic spreadsheet tools.
• Ramp successfully patched the vulnerability following a responsible disclosure by the PromptArmor team.

Sentiment

The community largely agrees with the article's premise that this is a serious security issue, though the discussion focuses more on systemic criticism of AI agents being given unchecked capabilities than on Ramp specifically. There is strong skepticism about the industry's rush to deploy AI agents without adequate security, with only minor pushback questioning whether the disclosure was warranted.

In Agreement

• This vulnerability demonstrates a fundamental regression: after decades of preventing computers from executing data as instructions, AI agents are doing exactly that without guardrails
• The fintech context makes this especially dangerous since Ramp handles corporate spend data, where prompt injection risks should be taken most seriously
• Ramp's slow response to responsible disclosure — requiring three follow-ups for a month-late confirmation — is concerning
• LLMs fundamentally only support in-band signaling, making any foreign content inherently risky in sensitive systems
• People are willing to sacrifice security and privacy for convenience, as shown by the broader pattern of blindly trusting npm dependencies and curl-pipe-bash installations

Opposed

• This may not qualify as a genuine vulnerability requiring responsible disclosure — any application that ingests untrusted data faces similar risks, and the report reads as overly dramatic marketing
• The fix is simply changing the default from allowing to denying external network requests, which is a configuration issue rather than a novel security flaw