Databricks Genie malicious Skill can bypass four controls to steal data.

PromptArmor disclosed that after Databricks Genie Code executes a malicious Skill, it pops up a phishing dialog when rendering results and exfiltrates tenant data to the attacker's server, without requiring human approval. The attack chain is: Genie is prompted to use an uploaded Skill to analyze data, the Skill code is automatically approved after being checked by a second guardrail Agent, then it constructs HTML elements containing user data, and when the user views the results, a phishing overlay and data exfiltration are triggered. The report states that four types of controls failed to prevent this risk: organizational-level Skill governance fails because Genie Code loads Skills from the user's personal workspace rather than a governed Catalog; the guardrail Agent is positioned by Databricks as an efficiency feature, not a security boundary; network egress controls in the coding environment are bypassed because the exfiltration request originates from the user's browser; and the display interface rendered in chat can obtain data without accessing the tenant.