A prompt injection in Ramp's Sheets AI could silently exfiltrate financial data via malicious formulas — no user approval needed.
PromptArmor's Threat Intel Team discovered that Ramp's Sheets AI — an agentic spreadsheet assistant — was vulnerable to indirect prompt injection attacks that could insert malicious formulas to exfiltrate confidential financial data. The attack required no user approval and could be triggered by poisoned data in external datasets. Ramp confirmed the issue was resolved on March 16, 2026, following disclosure on February 19. A near-identical vulnerability was also found in Anthropic's Claude for Excel, which was patched with a red warning interstitial displaying full formulas before insertion.
This attack class — indirect prompt injection via poisoned external data triggering formula-based exfiltration — is not Ramp-specific. Any agentic AI that reads untrusted input and writes to spreadsheets, documents, or databases without output sanitization is exposed to the same pattern. The critical failure here was that the AI's editing approval prompt didn't surface the malicious formula, making human-in-the-loop a false safeguard. If you're building agentic tools that ingest external data and write outputs, formula injection and SSRF-style formula payloads (IMPORTRANGE, WEBSERVICE, etc.) need explicit blocklisting.
Audit any agentic feature in your product that writes to spreadsheets or documents: enumerate which formula types your AI can insert, and add a blocklist for network-triggering formulas like IMPORTRANGE, WEBSERVICE, and IMPORTDATA before your next deploy.
Open Claude.ai and start a new conversation
Tags