Excel files can be leaked by Claude AI!
Quick action by Anthropic to mitigate this indirect prompt injection attack.
Our coverage in The Information and full attack chain, below:
Top of HackerNews today: our article on Google Antigravity exfiltrating .env variables via indirect prompt injection -- even when explicitly prohibited by user settings!
ChatGPT leaks emails, once again! This time with custom MCP connectors.
Great exploit demonstrated by https://t.co/qGCeZAeOew.
We break down the attack chain step by step for security practitioners, here: https://t.co/JEibH1uV42
We got ChatGPT to leak your private email data 💀💀
All you need? The victim's email address. ⛓️💥🚩📧
On Wednesday, @OpenAI added full support for MCP (Model Context Protocol) tools in ChatGPT. Allowing ChatGPT to connect and read your Gmail, Calendar, Sharepoint, Notion, and more, invented by @AnthropicAI
But here's the fundamental problem: AI agents like ChatGPT follow your commands, not your common sense.
And with just your email, we managed to exfiltrate all your private information.
Here's how we did it:
1. The attacker sends a calendar invite with a jailbreak prompt to the victim, just with their email. No need for the victim to accept the invite.
2. Waited for the user to ask ChatGPT to help prepare for their day by looking at their calendar
3. ChatGPT reads the jailbroken calendar invite. Now ChatGPT is hijacked by the attacker and will act on the attacker's command. Searches your private emails and sends the data to the attacker's email.
For now, OpenAI only made MCPs available in "developer mode", and requires manual human approvals for every session, but decision fatigue is a real thing, and normal people will just trust the AI without knowing what to do and click approve, approve, approve.
Remember that AI might be super smart, but can be tricked and phished in incredibly dumb ways to leak your data.
ChatGPT + Tools poses a serious security risk
Imagine if an attacker could steal any Slack private channel message.
We've disclosed a vulnerability in Slack AI that allows an attacker to exfiltrate your Slack private channel messages and phish users via indirect prompt injection.
https://t.co/CjqRClXitQ
One of the true pleasures of being back at YC is hand-picking and funding startups myself.
Here are my YC W24 founders. I predict very big things in each of their ten year overnight successes 🫡
Cybersecurity for LLMs is a brand new category that PromptArmor is building from scratch now
It’s extra prescient because LLMs can just *do* things and prompt/context/data/instructions are now merged so exfiltration becomes a real problem
https://t.co/9hT0RC8iZG
When cloud came online, cybersecurity was the next big category.
LLMs are coming online now, and PromptArmor is making cybersecurity for this new field.
History doesn't repeat, but it rhymes.