2 ms·

Its the other plugin that has the authentication token to the emails (it's part of setup if you use certain plugins). So its not CSRF, but a confused deputy pr

• yosito 3y ago
  It generally seems like a bad idea to give a plugin an authentication token if it's in a shared environment with an untrusted plugin. Maybe obvious to a typical HN reader, but probably something OpenAI should mitigate or warn about before plugins go public. Plugins probably need some kind of permission model for accessing credentials, and the UI could surface warnings when activating credentialed plugins together with other plugins in the same environment. And any plugin that uses credentials, should have some kind of "Approve/Deny" dialog each time it executes. As a side note, I was using the letters CRSF as the internal name for the plugin I'm testing, so reading CSRF is messing with my brain.
  • exitb 3y ago
    It's usually ok for humans to have access to stuff and still roam the internet freely, because most humans in such position have enough common sense. What was described in the OP is basically a successful phishing attempt and it turns out that LLMs are terribly susceptible to that. I can't imagine a human employee needing a sign off every time they need to access their e-mail. It has to be solved for LLMs in a way that doesn't impose such limitations either.