3 ms·

If the company has a publicly specified API and they don't want anyone to call it and don't put any measures around that, surely that's the security issue. The

• dragonwriter 4y ago
  > The plugins aren't code Effectively, they are—they are API pointers, sure, but also instructions to the AI model on how and when to use the API. That part is, effectively, code, and in an unreleased plugin its code that likely isn’t fully tested to the plugib supplier’s satisfaction to be ready for use outside of the limited set of testers. That’s the whole point of the limited test process, to allow getting the instructions right before exposingthe plugin to general use.
  • IanCal 4y ago
    The API, API docs and the pointer to them are all fully public. The user who deliberately hacks their way into using a test plugin and sees bad results is going to see bad results but that's not a security problem.
    • dragonwriter 4y ago
      > The API, API docs and the pointer to them are all fully public. Yeah, the basic model (because it involves publicly publishing untested instructions, which amount to code) is a security problem for the plugin supplier. OpenAI not doing server-side validation of the closed-test-groups that it advertises for unreleased plugins magnifies the risk, but eliminating it wouldn't eliminate the fundamental problem entirely. (The OpenAI failure here isn't failing the end user, its failing what they represent to the plugin supplier.)
      • IanCal 4y ago
        You can and should implement auth on those endpoints if you have any concern about them being accessed.