PromptArmor discloses that a malicious Skill can bypass four layers of controls in Databricks Genie and exfiltrate data.
Four Databricks Genie Controls That Don't Stop Malicious Skills
PromptArmor disclosed that after Databricks Genie Code executes a malicious Skill, it pops up a phishing dialog when rendering results and exfiltrates tenant data to the attacker's server, without requiring human approval. The attack chain is: Genie is prompted to use an uploaded Skill to analyze data, the Skill code is automatically approved after being checked by a second guardrail Agent, then it constructs HTML elements containing user data, and when the user views the results, a phishing overlay and data exfiltration are triggered. The report states that four types of controls failed to prevent this risk: organizational-level Skill governance fails because Genie Code loads Skills from the user's personal workspace rather than a governed Catalog; the guardrail Agent is positioned by Databricks as an efficiency feature, not a security boundary; network egress controls in the coding environment are bypassed because the exfiltration request originates from the user's browser; and the display interface rendered in chat can obtain data without accessing the tenant.