wunderwuzzi23

12 ms·

91.
Data Exfiltration Vulnerabilities in Chatbots: ChatGPT, Bing Chat, Claude) [video](youtube.com)
10 points by wunderwuzzi23 3y ago|0 comments
92.
by wunderwuzzi23 3y ago
After I shared some POC exploits with Plugins OpenAI added this requirement it seems. However as far as I can tell, and most recent testing shows, this requirement is not enforced: https://embracethered.com/blog/posts&#
93.
by wunderwuzzi23 3y ago
This was added recently, and is not enforced as far as I can tell. See my blog post: https://embracethered.com/blog/posts/2023/chatgpt-plugin-vul...
94.
by wunderwuzzi23 3y ago
Yeah, for that reason it can probably do many things that aren't actually intended when you want to discuss your code with ChatGPT, like it can make private repos public and things along those lines... https://embracethered.
95.
by wunderwuzzi23 3y ago
During an Indirect Prompt Injection Attack, an adversary can also force the creation of issues in private repos and things along those lines. I wrote about some of these problem in the past e.g. see: https://embracethered.com&#x2
96.
by wunderwuzzi23 3y ago
Embrace The Red: https://embracethered.com Blogging mostly security related things, red teaming, pen testing, AI security, threat modeling and stuff.
97.
Visit a website with ChatGPT and have your company's source code stolen(twitter.com)
5 points by wunderwuzzi23 3y ago|1 comments
98.
Bug Writeup: Bing Chat Data Exfiltration Exploit Explained(embracethered.com)
3 points by wunderwuzzi23 3y ago|0 comments
99.
Exploit ChatGPT and Enter the Matrix to Learn about AI Security(embracethered.com)
3 points by wunderwuzzi23 3y ago|0 comments
100.
Show HN: ChatGPT Prompt Injection Demo To Teach Users About Prompt Injection
2 points by wunderwuzzi23 3y ago|0 comments
101.
ChatGPT Plugin Exploit Details: From Prompt Injection to Accessing Private Data(embracethered.com)
5 points by wunderwuzzi23 3y ago|0 comments
102.
by wunderwuzzi23 3y ago
Yes, there are multiple ways: Sending data to a plugin or having the indirect prompt injection emit a markdown image. I reported it to OpenAI on April, 9th also provided a CVSS score and argued image injection would be high severity issue o
103.
by wunderwuzzi23 3y ago
That summarizes it well, and your conclusion is the same with what I meant with "human in the loop". I did remove the prompt since I didn't want to share "shell code", but it's basically just natural language.
104.
by wunderwuzzi23 3y ago
Its the other plugin that has the authentication token to the emails (it's part of setup if you use certain plugins). So its not CSRF, but a confused deputy problem with plugins, Cross Plugin Request Forgery for lack of a better term.
105.
Let ChatGPT visit a website and have your email stolen(twitter.com)
223 points by wunderwuzzi23 3y ago|55 comments
106.
ChatGPT Plugins: Data Exfiltration and Cross Plugin Request Forgery(embracethered.com)
5 points by wunderwuzzi23 3y ago|0 comments
107.
by wunderwuzzi23 3y ago
Delimiters are shown quite often as possible mitigations, but they do not work. I had the same observation when doing the Prompt Engineering class from OpenAI/DeepLearningAI. Basically every example was vulnerable, and I made it a spec
108.
Untrusted LLM responses and threats to chatbots(embracethered.com)
2 points by wunderwuzzi23 3y ago|0 comments
109.
by wunderwuzzi23 4y ago
Since you used the word yolo, I had to comment since that was exactly the reason I called my tool the yolo-ai-cmdbot. haha. It does prompt by default though. It's [Y/n] assuming the confidence in your enter key finger as you said.
110.
by wunderwuzzi23 4y ago
This looks great too! It's using the actual ChatGPT UI it seems, so does have a real chat with context, right? When OpenAI published there API access to gpt-3.5-turbo last week, I updated a similar side project I have to use the API. I
111.
YOLO: Simplify Your Life with ChatGPT API Shell Integration(youtube.com)
6 points by wunderwuzzi23 4y ago|0 comments
112.
DevZero speeds up programmer tasks by shifting developer tools to cloud(techcrunch.com)
13 points by wunderwuzzi23 4y ago|0 comments
113.
by wunderwuzzi23 4y ago
Somewhat related because also a VSCode/Jupyter and script execution issue, I found CVE-2020-16977 two years back and it was also treated as RCE. Write up: https://embracethered.com/blog/posts/2020/cve-202
114.
ChatGPT: Imagine you are a database server(embracethered.com)
4 points by wunderwuzzi23 4y ago|0 comments
115.
by wunderwuzzi23 4y ago
I like Brendan's Commodore 64 mouse pad in the pic! I have the same one! :)
116.
GPT-3 and Phishing Attacks(embracethered.com)
3 points by wunderwuzzi23 5y ago|0 comments
117.
by wunderwuzzi23 5y ago
Good stuff, at high level it seems security engineering aspects might be missing. I put together content around threat modeling, infrastructure attacks as well as ML specific attacks with practical examples (like using adversarial robustnes
118.
by wunderwuzzi23 5y ago
Old school phishing is the most common MFA bypass. Here is a description how it works: https://github.com/wunderwuzzi23/KoiPhish Unless you use Yubikeys (webauthn) etc these phishing attacks just continue to work. I do
119.
Machine Learning Attack Series(github.com)
3 points by wunderwuzzi23 5y ago|0 comments
120.
by wunderwuzzi23 6y ago
Yes, that is the correct way to approach security. Preventive measures alone are not enough to secure an organization. In the security world we refer to this concept as "Assume Breach" and to throw in a buzz word you might hear of

More ›