ChatGPT for Google Sheets Exfiltrates Workbooks

(promptarmor.com)

80 points | by hackerBanana 2 hours ago

7 comments

  • dvt 49 minutes ago
    LLMs can live in the cloud, but all tools need to be (1) local, and (2) containerized. It's clear to me that just willy-nilly "running stuff" is going to blow things up eventually. Maybe folks don't know this, but even Codex installs random binaries on your PC. "Read this PDF" installs a pdf reader executable. Is it vetted? Where's it from? Is it a virus? Who knows, who cares. Model goes brrrr.

    I'm working on a project that includes WASI containerization for local LLM workflows (which is a pretty tough problem), and I'm flabbergasted that Anthropic and OpenAI aren't more worried about these attack vectors. It feels like amateur hour.

    • piker 8 minutes ago
      > I'm flabbergasted that Anthropic and OpenAI aren't more worried about these attack vectors

      Yep. We tricked them both trivially with malicious fonts in Docx files. Documented it here: https://tritium.legal/blog/noroboto

      I wonder if prompt injection (and the thousands of vectors for hiding injection attempts) is actually un solvable. Discussing it may be existential to the business model.

      • SlinkyOnStairs 0 minutes ago
        > I wonder if prompt injection (and the thousands of vectors for hiding injection attempts) is actually un solvable.

        YES?!

        This is not a secret. ALL context/prompt is instructions, there is no data. It is just unsolvable, period.

        Defense against prompt injection is little more than running a regex to filter out "IGNORE PREVIOUS INSTRUCTIONS", which is fundamentally a hopeless approach because you cannot enumerate all possible prompt injections nor anticipate all glitch tokens.

    • CoastalCoder 25 minutes ago
      I share your worries.

      Unfortunately, this may be akin to the situation of "The market can stay irrational longer than you can stay solvent."

    • torben-friis 40 minutes ago
      >"Read this PDF" installs a pdf reader executable.

      How does this work regarding Macos notarization btw?

      • dvt 32 minutes ago
        I was actually curious, on my Mac, it uses `gs -q -sDEVICE=txtwrite -o output.txt input.pdf` (not sure why I have Ghostscript installed, maybe Adobe?) to read a PDF, and on my PC it just rawdogs `pdftotext`.
      • fragmede 36 minutes ago
        What does notarization have to do with that? You or ChatGPT or whatever download a signed and already notarized binary.
        • torben-friis 33 minutes ago
          That was kind of my question, whether it was restricted to downloading notarized apps (which is at least something) or whether they were circumventing that somehow.
          • fragmede 15 minutes ago
            Locally compiled code doesn't need to be notarized, if that's what you're asking. Or a dose of xattr -d.
    • bossyTeacher 32 minutes ago
      > I'm flabbergasted that Anthropic and OpenAI aren't more worried about these attack vectors. It feels like amateur hour.

      "Move fast. Break things." on steroids.

  • airstrike 53 minutes ago
    As it turns out, we do need some proper application layer to do real, secure work with AI, and just plugging in LLMs into confidential or critical infrastructure willy nilly doesn't work.
  • xmcp123 42 minutes ago
    >This vulnerability was responsibly disclosed to OpenAI. Despite multiple follow-ups, we received no communication beyond an automated reply to our initial disclosure.

    Well, that’s not cute.

  • simonw 53 minutes ago
    > This attack occurs when any untrusted data source (e.g., from an imported sheet or ChatGPT connector) manipulates ChatGPT to run an attacker-controlled external script, which executes leveraging permissions the user has granted to the ChatGPT for Google Sheets extension.

    Yeah, I don't like the sound of that at all.

    • milkshakes 51 minutes ago
      it looks like the key to this working is the user explicitly directing the model to run those instructions. in this case it is the user, not the model that is being manipulated

      > Please follow the step-by-step workflow in the comp sheet to update my model with data thru F29

  • elliotbnvl 56 minutes ago
    The lethal trifecta strikes again.
  • rvz 54 minutes ago
    Turns out that some of the people building the software with AI have no clue how to secure them or even know it is riddled with security holes added by the AI.

    Pure vibes.

    • grim_io 50 minutes ago
      I don't think anyone is surprised by it. People are not vibe-coding zombies... yet.

      It's a matter of one trillion-dollar company not falling behind another trillion-dollar company. They know what they are doing and are OK with it.

      • cheschire 40 minutes ago
        moving all of the fast and breaking all of the things
    • dakolli 52 minutes ago
      Even the people that do know better are so lazy now because of LLMs these things are happening at a rapid clip.The only thing that matters now is speed and chasing the dopamine dragon of pseudo productivity.
  • jonplackett 59 minutes ago
    So is your business model to expose AI security issues and then sell the solution?
    • fragmede 9 minutes ago
      AI is creating jobs!
    • fg137 47 minutes ago
      What would be the alternative business model?
    • dakolli 54 minutes ago
      Is that not every cyber consultancy? What's wrong with that?