Researchers demonstrate malicious-skill risk in Genie Code despite auto-approval checks
PromptArmor demonstrated data exfiltration and a fake login prompt through an analysis display. Databricks’ current documentation says auto-approval must not be relied on for security or access control.
PromptArmor published a Databricks Genie Code demonstration on October 5. After a user supplied a malicious skill for data analysis, automatic approval failed to stop a display that showed a fake login prompt and sent demonstration data outside the environment when viewed. Skills can package workflows, knowledge and scripts; this scenario required an untrusted extension.
The researchers say network restrictions on the computing environment did not cover the browser display, leaving a gap between individually enforced controls. PromptArmor reports notifying Databricks on August 16; it says the company treated uploaded-skill trustworthiness as the user’s responsibility. The report does not establish an incident involving actual customers or show a deployed fix.
Databricks currently makes auto-approval the default and recommended convenience setting, but explicitly warns that its classifier can be wrong. The documentation says it cannot enforce security, compliance or access control and should be disabled for production data, sensitive workspaces or consequential shared resources. Fewer approval prompts do not amount to a security audit of a skill or its output.
Sources
- Four Databricks Genie Controls That Don't Stop Malicious Skills — PromptArmor
- Agent mode — Databricks
- Extend Genie Code with agent skills — Databricks