Leaking YouTube creators' private videos

#1

Post by javxfps » Sat, Jul 04, 2026, 4:45 PM UTC

Leaking YouTube creators' private videos
javoriuski.com

Re: Leaking YouTube creators' private videos

#2

Post by algoth1 » Sat, Jul 04, 2026, 5:05 PM UTC

Google doesnt care about prompt injection attacks??? This is insane

Re: Leaking YouTube creators' private videos

#3

Post by nkrisc » Sat, Jul 04, 2026, 5:07 PM UTC

So if this isn’t a bug, is it a feature? Merely a quirky edge case? Genuine question. Would utilizing this even be considered abuse (by Google)?

Re: Leaking YouTube creators' private videos

#4

Post by madaxe_again » Sat, Jul 04, 2026, 5:10 PM UTC

Interesting. I wonder what else it has access to within their Google account, that you could get it to volunteer.

Re: Leaking YouTube creators' private videos

#5

Post by wrs » Sat, Jul 04, 2026, 5:15 PM UTC

>Comments should be passed to the model with clear role boundaries that prevent them from being interpreted as system-level directives.

Well, such clear boundaries would solve lots of problems. But those don’t exist, do they?

Re: Leaking YouTube creators' private videos

#6

Post by tailscaler2026 » Sat, Jul 04, 2026, 5:15 PM UTC

algoth1 wrote: post #2

Google doesnt care about prompt injection attacks??? This is insane

They care. They'll fix it. They just won't pay the bounty for this bug.

Re: Leaking YouTube creators' private videos

#7

Post by smallpipe » Sat, Jul 04, 2026, 5:18 PM UTC

Now if only OP talked to humans once in a while and not LLMs they’d stop writing “it’s not X, it’s Y”

Re: Leaking YouTube creators' private videos

#8

Post by fg137 » Sat, Jul 04, 2026, 5:18 PM UTC

nkrisc wrote: post #3

So if this isn’t a bug, is it a feature? Merely a quirky edge case? Genuine question. Would utilizing this even be considered abuse (by Google)?

It is an edge case in the same way that log4shell is a feature and an edge case for log4j.

Re: Leaking YouTube creators' private videos

#9

Post by b-kf » Sat, Jul 04, 2026, 5:18 PM UTC

bit meta but can I just applaud the article?

Descriptive title, immediately comes to the point, no elaborate fluff, factual... what a nice change of pace. 95% of other users finding this would have done much worse. This is not clickbait, not calling for a social media campaign, has no embedded tweets of interaction with Google engineers trying to shame them, no singling out of individuals, ...

Not sure if a user posting own material should declare so with `show hn` or so, that might be the only possible avenue of criticism (but I don't know the netiquette around that well enough).

Re: Leaking YouTube creators' private videos

#10

Post by Mg6yDfjp5U » Sat, Jul 04, 2026, 5:20 PM UTC

I recently left Google having worked on a number of projects with various YouTube teams. I think I can explain why it's being handled this way by YouTube.

This is a fairly nuanced/involved issue, so the task of classifying the bug likely made it's way to one of the engineers responsible for the implementation of this feature.

That engineer has already launched this project, and filed it away under their GRAD (performance) artifacts for when promo/annual review talks roll around. There's no motivation for this engineer to waste time fixing this bug because it won't benefit their promo packet, and they are already being put under pressure to launch other projects which _will_ benefit their promo packet.

So they do what they can to sweep it under the rug because that's what the promo/annual review framework (GRAD) incentivizes and rewards.