Uncovering Critical Security Flaws in ChatGPT Plugins: A Threat to User Accounts?

Salt Security has discovered critical security flaws in ChatGPT plugins that could allow attackers to access users' third-party accounts and sensitive data. The vulnerabilities were found in the plugin functionality of ChatGPT, which allows the AI chatbot to interact with external services. The flaws could introduce a new attack vector and enable threat actors to gain control of users' accounts on third-party websites and access to personally identifiable information (PII) and other sensitive user data stored within third-party applications. The discovery highlights the importance of protecting the plugins within generative AI tools to prevent attackers from accessing critical business assets and executing account takeovers. The Salt Labs team identified three distinct types of vulnerabilities in their investigation within the ChatGPT plugins, including a flaw within ChatGPT itself, a vulnerability in PluginLab (pluginlab.ai), and susceptibility to OAuth redirection manipulation in multiple plugins. The findings come weeks after Imperva detailed two cross-site scripting (XSS) vulnerabilities in ChatGPT and several of its third-party plugins that risked leakage of user conversations and other account contents. The vulnerabilities were reported to ChatGPT and plugin developers in July and September 2023, respectively, and have since been resolved. Users are advised to update their apps as soon as possible, and developers are recommended to be more aware of the internals of the generative AI (GenAI) ecosystem to prevent similar vulnerabilities in the future.

Related reads

Popular posts from this blog

Meta CTO Reveals Latest Updates on AR Glasses: AI-Powered and Beyond!

Meta is working on developing immersive augmented reality (AR) glasses that could potentially replace smartphones. These glasses are designed to be cost-effective and integrate AI, with the goal of making them accessible to everyone. The company is currently working on prototypes for 2024, 2026, and 2028, with the aim of releasing the glasses by the end of the decade. One of the main challenges is creating displays that are both clear and high-quality yet cost-effective. Additionally, the company is working on manufacturing new materials for the glasses and finding ways to give them enough power without needing frequent charging. AI is expected to make the glasses more useful than anticipated, and could help with tradeoffs on other parts of the design. The article highlights the significance of AI in product roadmaps, including those of Meta, and how it is becoming a primary way people interact with machines. Related reads Larry Magid: Meta, Ray-Ban release second-generation smart gla...
Read more

GTA 6: The Most Anticipated Game Release in History?

The games industry is currently facing challenges such as cost-cutting measures, layoffs, studio closures, and game cancellations. However, the upcoming release of Grand Theft Auto 6 (GTA 6) is highly anticipated and expected to be a major success, with some analysts predicting it could be the best-selling video game of all time. The game's release is seen as critical for the video game industry, which is currently experiencing a decline in revenue and growth. GTA 6 has the potential to boost the bottom line of companies involved in the video game industry, including retailers like Amazon and GameStop, as well as console manufacturers like Sony and Microsoft. The game's success could also lead to increased interest in video games and gaming overall, potentially leading to a renewed growth period for the industry. However, the development of GTA 6 has been marred by reports of crunch and other issues within Rockstar Games, highlighting the challenges faced by developers in the i...
Read more

Google Unveils Revolutionary Password Security Feature for iPhone Users

Google has recently upgraded the security protection for iPhone users by introducing a new real-time system for detecting and warning users about unsafe websites in Chrome. This new system replaces the current local list-based system and includes flagging weak and reused passwords, blocking 25% more phishing attempts, and providing real-time protection against risky websites on Chrome for desktop, iOS, and soon Android. The new system uses an asynchronous mechanism to prevent network calls from blocking page loads and degrades the user experience, and it also includes an option to turn it off in the browser settings. Additionally, Google has partnered with Fastly, a CDN and edge computing specialist, to provide an additional layer of privacy by stripping out any identifying information from the browser request. The new system is currently available in Chrome's Standard mode and offers additional protection in Enhanced mode, including AI-based blocking, deep file scans, and protecti...
Read more