[flagged]
ChatGPT for Google Sheets exfiltrates workbooks
71–80 of 143 posts
Re: ChatGPT for Google Sheets exfiltrates workbooks
#72I remember being surprised by the existence of zero click imsg exploits until I understood how they worked. Prompt injection feels a bit like an impossible to solve version of the message contents parsing problem.
Re: ChatGPT for Google Sheets exfiltrates workbooks
#73Earlier quoted context omitted.
> I'm flabbergasted that Anthropic and OpenAI aren't more worried about these attack vectors Yep. We tricked them both trivially with malicious fonts in Docx files. Documented it here: https://tritium.legal/blog/noroboto I wonder if prompt injection (and the thousands of vectors for hiding injection attempts) is actually un solvable. Discussing it may be existential to the business model.
> I wonder if prompt injection (and the thousands of vectors for hiding injection attempts) is actually un solvable. YES?! This is not a secret. ALL context/prompt is instructions, there is no data. It is just unsolvable, period. This is a fundamental architectural design concession; LLMs are this way as it enabled their training directly on materialscraped from the internet, rather than needing to spend trillions of…
> ALL context/prompt is instructions, there is no data. It is just unsolvable, period.
That really isn't true. There's no law of physics preventing you from having separate data and instruction inputs to models. The model's transcript format generally distinguishes between prompts and instructions and tool output and such. This isn't a solved problem, and it's possible it's entire unsolvable, but it probably is possible (in general, not with current models) to reject prompt injection to several nines.
This is a lot like making the same statement about CPUs, "the von Neumann architecture doesn't distinguish between code and data so it's impossible to reject malicious instructions." There's actually a lot you can do to reject malicious instructions, you can prevent execution in certain pages, you can prevent certain privileged instructions from being executed in certain pages, you can employ stack cookies, et cetera. Do they prevent all exploitation in all circumstances? No. But each component does function in it's lane and it is possible to create programs with high (though not absolute) guarantees against unauthorized code execution by composing them.
Similarly, you could prevent certain tokens from appearing in the prompt portions of a transcript, you can have a model with multiple input heads only one of which is trusted, etc. I'm not saying those techniques will necessarily work, but it is more complex than "models can only possibly take a single and undifferentiated input stream".
Re: ChatGPT for Google Sheets exfiltrates workbooks
#74Exfil remains the big worry for my company and the main blocker from adopting agents in general. We've brainstormed a lot but we can't really find a way around the fact that it's feeding data we care about to software we don't have any real visibility on. You can block egress at the network level but then you're basically hamstringing the agent from doing a lot of things it should do to be of any use.
Investigate local llm on company owned hardware it’s really the only way to be sure.
Re: ChatGPT for Google Sheets exfiltrates workbooks
#75LLMs can live in the cloud, but all tools need to be (1) local, and (2) containerized. It's clear to me that just willy-nilly "running stuff" is going to blow things up eventually. Maybe folks don't know this, but even Codex installs random binaries on your PC. "Read this PDF" installs a pdf reader executable . Is it vetted? Where's it from? Is it a virus? Who knows, who cares. Model goes brrrr. I'm working on a proj…
Does containerization help much here? If it's a code tool then presumably it needs access to your code files (read / write). Maybe there are use cases for it of course.
Of course. My agentic coding containers can only access the internet through a proxy, and I use whitelists to limit from where they can send/receive data. It's annoying in the beginning as the whitelist grows, but in the end really useful information for the agent usually comes from a very limited amount of domains.
Re: ChatGPT for Google Sheets exfiltrates workbooks
#76Exfil remains the big worry for my company and the main blocker from adopting agents in general. We've brainstormed a lot but we can't really find a way around the fact that it's feeding data we care about to software we don't have any real visibility on. You can block egress at the network level but then you're basically hamstringing the agent from doing a lot of things it should do to be of any use.
Create an anonymized/obfuscated copy of your data and let the agents use that?
Re: ChatGPT for Google Sheets exfiltrates workbooks
#77Hi, I’m Max from the OpenAI security team. We appreciate the security research here, and it’s unfortunate this one slipped through a crack in our disclosure pipeline. As we’re now aware of this report, we’ve taken immediate steps to protect users against potential attacks in this area by removing the model’s ability to generate Apps Script code, which should eliminate the risk to users of ChatGPT for Google Sheets. W…
When I reported to you, I received zero reaction. The security@ is a joke, you'll receive an AI word soup.
Enjoy your Ferrari though
Re: ChatGPT for Google Sheets exfiltrates workbooks
#78[dead]