During an Indirect Prompt Injection Attack, an adversary can also force the creation of issues in private repos and things along those lines. I wrote about som

During an Indirect Prompt Injection Attack, an adversary can also force the creation of issues in private repos and things along those lines. I wrote about some of these problem in the past e.g. see: https://embracethered.com/blog/posts/2023/chatgpt-plugin-vulns-chat-with-code/ https://embracethered.com/blog/posts/2023/chatgpt-plugin-vul... on how an attacker might steal your code. Some other related posts about ChatGPT plugin vulnerabilities and exploits: https://embracethered.com/blog/posts/2023/chatgpt-cross-plugin-request-forgery-and-prompt-injection./ https://embracethered.com/blog/posts/2023/chatgpt-cross-plug... https://embracethered.com/blog/posts/2023/chatgpt-webpilot-data-exfil-via-markdown-injection/ https://embracethered.com/blog/posts/2023/chatgpt-webpilot-d... Its not very transparent when and why a certain plugin gets invoked and what data is sent to it. One can only inspect afterwards basically.