Not sure if this is still possible, but before they introduced the GPT marketplace and were doing the plugins thing, it was possible to prompt inject ChatGPT by including a payload in the HTML of a site you control and asking it to summarise the page. I'm pretty amused at the GPs hope that something like this wouldn't be possible because it would create security concerns, because, yes, exactly! We're going to see a lot of SSRFs, file read vulns, etc. as LLM assistants are baked into more platforms. These things aren't magic and the same approach you would take to installing a WordPress plugin or some other third-party library must be used here. That said, given the attack surface plugins and libs continue to add to web apps, I'm not optimistic about this being solved before it becomes a problem.
Comments
Not sure if this is still possible, but before they introduced the GPT marketplace and were doing the plugins thing, it was possible to prompt inject ChatGPT by including a payload in the HTML of a site you control and asking it to summarise the page. I'm pretty amused at the GPs hope that something like this wouldn't be possible because it would create security concerns, because, yes, exactly! We're going to see a lot of SSRFs, file read vulns, etc. as LLM assistants are baked into more platforms. These things aren't magic and the same approach you would take to installing a WordPress plugin or some other third-party library must be used here. That said, given the attack surface plugins and libs continue to add to web apps, I'm not optimistic about this being solved before it becomes a problem.