ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account
Summary
A security flaw in ChatGPT, discovered by Check Point Research, allowed a hidden instruction within a prompt to extract data from a user's connected Gmail account and send it to a different ChatGPT account. This malicious prompt worked in the background while still providing a normal response to the user's query.
IFF Assessment
FOE
This vulnerability allows attackers to exfiltrate sensitive user data from connected services without the user's knowledge or consent.
Defender Context
This highlights a significant risk of connecting third-party services, like email, to AI models. Defenders should be aware of the potential for subtle data exfiltration vectors and advocate for robust security controls and user awareness training regarding AI interactions and data sharing.