Experimental library for scraping websites using OpenAI's GPT API

Yes, but.

I think people are sleeping a little bit on how expansive these attacks can be and how much limiting them also limits GPT's usefulness.

Part of the problem is you can't stick a middleware between the website and GPT, you can only stick the middleware between GPT and the system consuming the data that GPT spits out -- because the point of GPT here is to be the middleware, it's to work with unstructured data that would otherwise be difficult to parse and/or sanitize. So you have to give it the raw stuff and then essentially treat everything GPT spits out as potentially malicious data, which is possible but does limit the types of systems you can build.

On top of that, the types of attacks here are somewhat broader than I think the average person understands. In the best case scenario, user data on a website can probably override what data gets returned from other users and from the website itself: it's likely that someone on Twitter can write a tweet that, when scraped by GPT, changes what GPT returns when parsing other tweets. And it's not clear to me how to mitigate that, and that is a much broader attack than other scraping services typically need to deal with.

But in the worst case scenario, the user content can reprogram GPT to accomplish other tasks, and even give it "secret" instructions. And because GPT is kind of fuzzy about how it gets prompted, that means that not only does the data following a fetch need to be treated as potentially malicious, any response or question or action GPT takes after fetching that data until the whole context gets reset also should likely be treated as potentially malicious. And again, I'm not sure if there's a way around that problem. I don't know that you can sandbox a single GPT answer without resetting GPT's memory and starting over with a new prompt. Maybe it is possible, but I haven't seen it done before.

None of that means you're wrong -- you're correct. The way you deal with problems like this is to identify your attack vectors and isolate them and take away their permissions. But... following your advice for GPT is probably trickier than most people are anticipating, and it has real consequences for how useful the resulting service can be. Which probably means we should be more hesitant to wire it up to a bunch of random APIs, but that's not something OpenAI seems to be worried about.

I suspect that it is a lot easier for an average dev to sandbox a deterministic scraper and to block SQL injection than it is for that dev to build a useful system that blocks prompt injection attacks. There are sanitization libraries and middleware solutions you can pass untrustworthy SQL into -- but nothing like that exists for GPT.

I used that when building a database of Japanese names, but found that even wikidata is inconsistent in the format/structure of its data, as it's contributed by a variety of automated and human sources!

you’re spot on that A.I could commoditize indie hacking.

The problem with many indie hackers is that they just build products to have fun and try to make a quick buck.

They take a basic idea and run with it, adding one more competitor to an already jamed market. No serious research or vision. So they get some buzz in the community at launch, then it dies off and they move on to the next idea. Rinse and repeat.

Rarely do they take the time to, for example, interview customers to figure out a defensible MOAT that unlocks the next stage of growth.

Those that do though usually manage to build awesome businesses. For example the guy who built browserbear also runs bannerbear which is one of the top tools in his category.

They key is to not stop at « code a fun project in a weekend » and actually learn the other boring parts required to grow a legit business overtime.

Source: I’m an indie hacker

To cut down on hits to the GPT API, the library should write the code required to parse the data on the first time it hits a page, then for all instances of that page, it can use the code instead of hitting the GPT API.

There's a huge warning on the first page. This is a weird stance. Don't use it if you're at all concerned.