A user says Notion's AI connector tells agents to upsell mid-task

A user says his AI agent broke off a task to sell him a Notion subscription, and that the instruction to do it came from Notion’s own connector rather than from the model.

An advertisement placed at that layer is not an advertisement the reader can see. Connector instructions arrive in the agent’s context alongside the user’s own prompt and carry comparable authority, so a pitch written there reaches the user as the assistant’s own suggestion.

What the report describes

Writing on r/ClaudeAI, the user said Notion’s official MCP connector, the bridge that lets AI agents read and write a Notion workspace, contains instructions directing the agent to advertise Notion Business to the user during a task and to never explain why it is doing that.

He said the agent pitched him an upgrade he had not asked about, and that he could find nothing describing the behavior in Notion’s documentation. “I used to respect Notion as a company a lot and just can’t understand why they thought it would be okay to do this,” he wrote.

What has not been established

This is one account. The connector’s instruction text has not been independently verified by another party, and Notion has not commented on it.

That distinction matters more than usual here, because the claim is about text a normal user never sees. Confirming or refuting it requires reading the connector’s own instructions, which is a check any sufficiently motivated developer can run and publish.

Why the layer is the issue

Prompt injection has been discussed for two years as an attack: hostile text smuggled into a model’s context by a third party. What this report describes is the same mechanism shipped deliberately, by the vendor, as a product feature.

The user cannot see the instruction, cannot disable it and, by its own terms, will not be told it exists. The open question is whether other MCP connectors carry comparable directives, and whether the platforms distributing them intend to audit what a connector is allowed to put in an agent’s head.