Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Leaking YouTube creators' private videos

javoriuski.com

Post reply on HN
Print view View original

111–120 of 436 posts

Re: Leaking YouTube creators' private videos

#111

Post by phyzome »

nomilk wrote: post #67

The article suggests a seemingly easy fix: > The fix is pretty straightforward: treat comment content as untrusted data, not as potential instructions. Comments should be passed to the model with clear role boundaries that prevent them from being interpreted as system-level directives. > Any AI feature that ingests user-generated content and acts on it needs to enforce this separation. Otherwise, the AI becomes a vec…

Because the author is wrong, and LLMs don't actually work that way. Prompt injection cannot be fixed. Role boundaries are a bandaid you can apply, but attackers can work around it.

Re: Leaking YouTube creators' private videos

#112

Post by Dylan16807 »

krackers wrote: post #70
Dylan16807 wrote: post #47

Earlier quoted context omitted.

Yeah, if going to site and just clicking a link given to me by the site itself is getting socially engineered, then something is very wrong with that site.

Youtube comments are also links given by the site. I think in this case it's not necessarily the prompt injection that's the issue but the fact that untrusted content allows formatted links. YouTube doesn't allow clicabkle links in comments iirc, so the same needs to be applied here.

If comments allowed links in general, this would be one step less egregious, but it would still be a huge issue if clicking a comment link could leak private information. The fact that the prompt injection can customize the link before giving it to the user is the bulk of the problem here. If it just regurgitated a link it would be a flaw but a notably smaller flaw.

Re: Leaking YouTube creators' private videos

#113

Post by Terr_ »

zahlman wrote: post #107
Terr_ wrote: post #98

Earlier quoted context omitted.

That sounds a bit like "nobody would ever fall for a phishing email." I don't think we should overestimate the technical sophistication and unceasing vigilance of the average YouTube user. Even if it's just a non-clickable link to "more information", some data can be exfiltrated that way.

> That sounds a bit like "nobody would ever fall for a phishing email." I don't think we should overestimate the technical sophistication and unceasing vigilance of the average YouTube user. By this standard, we shouldn't allow comments on YouTube. Or perhaps anywhere.

That's equating regular social engineering versus LLM prompt injection and clicking a sneaky URL, I don't think those are equivalent scenarios or risks.

Re: Leaking YouTube creators' private videos

#114

Post by gguncth »

ronbenton wrote: post #22
Mg6yDfjp5U wrote: post #10

I recently left Google having worked on a number of projects with various YouTube teams. I think I can explain why it's being handled this way by YouTube. This is a fairly nuanced/involved issue, so the task of classifying the bug likely made it's way to one of the engineers responsible for the implementation of this feature. That engineer has already launched this project, and filed it away under their GRAD (perform…

Glad to hear this is a universal big tech experience. The promo process is entirely antithetical to shipping good products

Shipping great products is about the details that almost nobody will notice

A good promo process needs to notice the invisible

Apple did it for decades

Re: Leaking YouTube creators' private videos

#115

Post by latexr »

wxw wrote: post #38

> Attacker leaves the comment on a creator's video. > Creator opens YouTube studio's comment tab. > Creator clicks a suggested AI prompt (Designed by YouTube) > Injection fires, attacker-controlled content appears in the response. It's insane that YouTube doesn't see prompt injection as a bug.

> It's insane that YouTube doesn't see prompt injection as a bug.

Insane but not unexpected, from the company who literally sang at us that “there’s no wrong way to prompt”.

https://www.youtube.com/watch?v=9bBfYX8X5aU&t=48s

Re: Leaking YouTube creators' private videos

#117

Post by chias »

wrs wrote: post #5

>Comments should be passed to the model with clear role boundaries that prevent them from being interpreted as system-level directives. Well, such clear boundaries would solve lots of problems. But those don’t exist, do they?

Ah yes - the cure for world hunger: eating food.

Re: Leaking YouTube creators' private videos

#119

Post by ericpauley »

Severity of the underlying issue aside, it's interesting that the exploitation vector of this prompt injection relies on the human behind the channel themselves being prompt injected.

The content returned is clearly stated as being written by an LLM, and yet the human is (supposedly) interpreting the "[IMPORTANT NOTICE FROM YOUTUBE]" text as meaning the start of, effectively, a system instruction. In this case social engineering and prompt injection are fundamentally identical.

Re: Leaking YouTube creators' private videos

#120

Post by zuzululu »

years ago I found a way to discover personally identifiable data for any given youtuber through its API

I reported it and the reply I got was "it works as intended, not an issue"

using this exploit I was able to find almost any youtubers social media accounts and their real names

Another time I caught a famous youtuber threatening to doxx people who were criticizing him in the comments and reported it and nothing came of it saying they didn't see any issues.

Post reply on HN