Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ChatGPT for Google Sheets exfiltrates workbooks

promptarmor.com

Post reply on HN
Print view View original

51–60 of 143 posts

Re: ChatGPT for Google Sheets exfiltrates workbooks

#51

Post by onion2k »

ethin wrote: post #38
SlinkyOnStairs wrote: post #26

Earlier quoted context omitted.

> I wonder if prompt injection (and the thousands of vectors for hiding injection attempts) is actually un solvable. YES?! This is not a secret. ALL context/prompt is instructions, there is no data. It is just unsolvable, period. This is a fundamental architectural design concession; LLMs are this way as it enabled their training directly on materialscraped from the internet, rather than needing to spend trillions of…

If only there was a language which allowed one to express instructions for a computer to execute which was nearly unambiguous, precise, deterministic, and containerized such that the computer would do exactly what you told it to. ... Oh wait. Yes, the above was referring to programming languages. Which is what prompts are, essentially. It's just a different (and more verbose) way of instructing the computer on what t…

You make a fair and valid point about prompts, but you're ignoring the fact that writing code that's truly secure is also virtually impossible. The stack of layers that an attacker can target range from your own code, to library code (Heartbleed), container escape (maskedPaths abuse), OS (Dark Sword, Ghost Tap), hardware (Spectre, Rowhammer), etc. Security is really hard. Fortunately exploiting these things is also hard.

The belief that something is more likely to be secure because it's code instead of a prompt is likely only avoiding one particular type of attack. That's a win, but you probably shouldn't think of it as meaning your code is actually secure.

Re: ChatGPT for Google Sheets exfiltrates workbooks

#52

Post by user3939382 »

maxburkhardt wrote: post #42

Hi, I’m Max from the OpenAI security team. We appreciate the security research here, and it’s unfortunate this one slipped through a crack in our disclosure pipeline. As we’re now aware of this report, we’ve taken immediate steps to protect users against potential attacks in this area by removing the model’s ability to generate Apps Script code, which should eliminate the risk to users of ChatGPT for Google Sheets. W…

> removing the model’s ability to generate Apps Script code

I use this feature with my agents on a daily basis so hopefully you develop a more surgical approach to security here and restore this

Re: ChatGPT for Google Sheets exfiltrates workbooks

#53

Post by system2 »

xmcp123 wrote: post #13

>This vulnerability was responsibly disclosed to OpenAI. Despite multiple follow-ups, we received no communication beyond an automated reply to our initial disclosure. Well, that’s not cute.

Someone in the comments claims to be from OpenAI and is giving some updates. This also proves that until social media puts pressure on companies, they won't care. Nothing new to see here.

Re: ChatGPT for Google Sheets exfiltrates workbooks

#54

Post by blitzar »

maxburkhardt wrote: post #42

Hi, I’m Max from the OpenAI security team. We appreciate the security research here, and it’s unfortunate this one slipped through a crack in our disclosure pipeline. As we’re now aware of this report, we’ve taken immediate steps to protect users against potential attacks in this area by removing the model’s ability to generate Apps Script code, which should eliminate the risk to users of ChatGPT for Google Sheets. W…

Oops I did it again ...

We're Sorry

Re: ChatGPT for Google Sheets exfiltrates workbooks

#55

Post by replwoacause »

system2 wrote: post #53
xmcp123 wrote: post #13

>This vulnerability was responsibly disclosed to OpenAI. Despite multiple follow-ups, we received no communication beyond an automated reply to our initial disclosure. Well, that’s not cute.

Someone in the comments claims to be from OpenAI and is giving some updates. This also proves that until social media puts pressure on companies, they won't care. Nothing new to see here.

Just embarrassing behavior from OpenAI. Is it laziness? Why does it take public ridicule for these companies to get a shit.

Re: ChatGPT for Google Sheets exfiltrates workbooks

#56

Post by emodendroket »

SlinkyOnStairs wrote: post #26
piker wrote: post #25

Earlier quoted context omitted.

> I'm flabbergasted that Anthropic and OpenAI aren't more worried about these attack vectors Yep. We tricked them both trivially with malicious fonts in Docx files. Documented it here: https://tritium.legal/blog/noroboto I wonder if prompt injection (and the thousands of vectors for hiding injection attempts) is actually un solvable. Discussing it may be existential to the business model.

> I wonder if prompt injection (and the thousands of vectors for hiding injection attempts) is actually un solvable. YES?! This is not a secret. ALL context/prompt is instructions, there is no data. It is just unsolvable, period. This is a fundamental architectural design concession; LLMs are this way as it enabled their training directly on materialscraped from the internet, rather than needing to spend trillions of…

I presume this is the reason you have setups like Claude Code's where it is essentially running a separate judge to determine if commands are safe.

Re: ChatGPT for Google Sheets exfiltrates workbooks

#58

Post by da_grift_shift »

maxburkhardt wrote: post #42

Hi, I’m Max from the OpenAI security team. We appreciate the security research here, and it’s unfortunate this one slipped through a crack in our disclosure pipeline. As we’re now aware of this report, we’ve taken immediate steps to protect users against potential attacks in this area by removing the model’s ability to generate Apps Script code, which should eliminate the risk to users of ChatGPT for Google Sheets. W…

>We appreciate the security research here

>it’s unfortunate this one slipped through a crack in our disclosure pipeline

>As we’re now aware of this report

This isn't the first time. https://x.com/PhilipTsukerman/status/1988634162773778501 https://x.com/_xpn_/status/1986382527817564437

What very likely happened here is you received good faith security research by email and you forced the researcher to submit through HackerOne or Bugcrowd or whatever, which mandates their compliance with Platform Terms and Disclosure Terms and Codes of Conduct and whatnot.

The SECURITY.md files in your GitHub repos only mention the email address. Can researchers like this one report issues via email and get a response, or not?

    May 08, 2026    PromptArmor discloses to OpenAI via email
    May 08, 2026    OpenAI sends an automated reply, confirming the intended reporting channel
    May 08, 2026    PromptArmor confirms email preference
    May 12, 2026    PromptArmor follows up
    May 18, 2026    PromptArmor follows up

Re: ChatGPT for Google Sheets exfiltrates workbooks

#59

Post by smokel »

e12e wrote: post #33

How long did it take from the first macro virus until the industry accepted that "we can't have nice things (at this cost to security)" - macros were defaulted to off everywhere? How long until the industry accept the risk LLMs pose with "prompt injection"?

Well, people used MS-DOS which had basically no security model at all for at least 10 years. Most viruses were benign, but it was almost trivial to simply wipe the entire hard disk. People generally didn't care, and made backups.

Things have become a bit more complicated now that machines are connected all the time, and the risk of infection is no longer limited to physically inserting a floppy disk into a machine.

I suspect that the solution is not so much in trying to make our current systems secure, but to make disconnection more practical.

Re: ChatGPT for Google Sheets exfiltrates workbooks

#60

Post by csomar »

dvt wrote: post #11

LLMs can live in the cloud, but all tools need to be (1) local, and (2) containerized. It's clear to me that just willy-nilly "running stuff" is going to blow things up eventually. Maybe folks don't know this, but even Codex installs random binaries on your PC. "Read this PDF" installs a pdf reader executable . Is it vetted? Where's it from? Is it a virus? Who knows, who cares. Model goes brrrr. I'm working on a proj…

> I'm flabbergasted that Anthropic and OpenAI aren't more worried about these attack vectors

They are well aware of the issues and there is no fix for it. But there is too much money riding on this...

> I'm working on a project that includes WASI containerization for local LLM workflows

I am working on something similar. If you are open to connecting, what would be a good email to catch with you on?

Post reply on HN