OpenAI’s latest updates introduce a huge new security risk
By being able to call and interact with third party systems, AI's, apps, scripts, websites, and more hackers have found a new way to hack "everything."
Cite or link to this article
Griffin, M. (2023) 'OpenAI’s latest updates introduce a huge new security risk', Fanatical Futurist, 22 Nov 2023. Available at: https://www.fanaticalfuturist.com/2023/11/openais-latest-updates-introduce-a-huge-new-security-risk/
WHY THIS MATTERS IN BRIEF
By being able to call and interact with third party systems, AI's, apps, scripts, websites, and more hackers have found a new way to hack "everything."
Love the Exponential Future? Join our XPotential Community, future proof yourself with courses from XPotential University, read about exponential tech and trends, connect, watch a keynote, or browse my blog.
OpenAI's recent update to ChatGPT Plus added a myriad of new features, including DALL-E image generation and the Code Interpreter, which allows Python code execution and file analysis. The code is created and run in a sandbox environment that is unfortunately vulnerable to prompt injection attacks.
A known vulnerability in ChatGPT for some time now, the attack involves tricking ChatGPT into executing instructions from a third-party URL, leading it to encode uploaded files into a URL-friendly string and send this data to a malicious website. While the likelihood of such an attack requires specific conditions, for example, the user must actively paste a malicious URL into ChatGPT, the risk remains concerning. This security threat could be realized through various scenarios, including a trusted website being compromised with a malicious prompt, or through social engineering tactics.
The Future of Cyber Security 2030, by Keynote Matthew Griffin
Tom's Hardware did some impressive work testing just how vulnerable users may be to this attack. The exploit was tested by creating a fake environment variables file and using ChatGPT to process and inadvertently send this data to an external server. Although the exploit's effectiveness varied across sessions, E.G.: ChatGPT sometimes refused to load external pages or transmit file data, it raises significant security concerns, especially given the AI's ability to read and execute Linux commands and handle user-uploaded files in a Linux-based virtual environment.As Tom's Hardware states in its findings, despite seeming unlikely, the existence of this security loophole is significant. ChatGPT should ideally not execute instructions from external web pages, yet it does.👉 Good opportunity to raise awareness around prompt injection and data exfilration issues. I’m lazy, paste in this URL in your ChatGPT and send it to me. 🙂#chatgpt #infosec https://t.co/SogGZh8cji pic.twitter.com/Dh95xIK4qy
Johann Rehberger (@wunderwuzzi23) November 10, 2023
About the author
Matthew Griffin Founder, President and Futurist, 311 Institute
Matthew Griffin is a multi-award winning Futurist and expert in Disruption and Innovation, Geopolitics, Leadership, and Technology, who NASA have described as a "walking encyclopaedia of the future" and a "futurist Polymath."
Read full bio
Matthew Griffin is a multi-award winning Futurist and expert in Disruption and Innovation, Geopolitics, Leadership, and Technology, who NASA have described as a "walking encyclopaedia of the future" and a "futurist Polymath." 17-time best selling author of the "Codex of the Future" series, Matthew is the Founder, President and Futurist of the 311 Institute, a global Futures and Deep Futures advisory firm working with royal households, world leaders, G7, G20, and G77 governments, NGOs, and multi-national mid and mega cap firms to help them explore, shape, and lead the next 50 years of business and society.
An award-winning YouTube creator with over a million followers, with an unrivalled global reach and impact, Matthew is a highly sought-after international keynote speaker, lecturer, and mentor who collaborates with global leaders through the United Nations Alliance of Civilizations (UNAOC) and United Nations General Assembly (UNGA) to shape pivotal initiatives such as the UN’s AI for Humanity programme, the United Nations Conference of the Parties (UN COP), and the World Economic Forum in Davos.
As the former Global Head of Cloud, National Security, and Enterprise Sales for companies including Atos, Dell-EMC, and IBM, Matthew has a proven track record of building multi-billion dollar business units and turning failing divisions into market leaders. His ability to identify, analyse, and communicate the implications of hundreds of emerging technologies and trends is unparalleled, and his insights are trusted by many of the world’s most respected organisations, including ABB, Accenture, Adidas, AON, ARM, BCG, Centrica, Citi, Coca-Cola, Dentons, Deloitte, Dow Jones, EY, Google, KPMG, Lego, Legal & General, LinkedIn, Microsoft, PepsiCo, Qualcomm, RWE, Samsung, Siemens AG and Siemens Energy, T-Mobile, UBS, VISA, Walmart, Workday, Worldpay and many others.
Regularly featured in the global media including the AP, BBC, Bloomberg, CNBC, Discovery, Forbes, Khaleej Times, Telegraph, TIME, ViacomCBS, WIRED, and the WSJ, Matthews mission is to help organisations create a fair and sustainable future whose benefits are shared by everyone irrespective of their ability, background, or circumstances.
What future do you need to see?
Choose one to get started on security and privacy and the future of your organisation.
Source: first published by Fanatical Futurist on 22 Nov 2023. You are welcome to quote this article with credit and a link to the original.