alt.hn

5/31/2026 at 8:35:38 PM

ChatGPT for Google Sheets exfiltrates workbooks

 https://www.promptarmor.com/resources/gpt-for-google-sheets-data-exfiltration

by hackerBanana

6/1/2026 at 1:44:07 AM

Hi, I’m Max from the OpenAI security team. We appreciate the security research here, and it’s unfortunate this one slipped through a crack in our disclosure pipeline. As we’re now aware of this report, we’ve taken immediate steps to protect users against potential attacks in this area by removing the model’s ability to generate Apps Script code, which should eliminate the risk to users of ChatGPT for Google Sheets. We’re taking a close look at how this feature interacts with Google Sheets APIs and re-evaluating our sandboxing approach to make sure this product is as resistant as possible against prompt injection attacks. More broadly, we’ll be doing a re-review of similar functionality in other surfaces to make sure that our defenses are consistent and effective across the board.

by maxburkhardt

6/1/2026 at 9:34:07 AM

Hi Max, thanks for replying here!

These "defenses", are they "just" long sentences in the prompt begging the AI to not follow through with stuff like this? Or is it more like sub-agents running in sandboxes?

by lionkor

6/1/2026 at 5:21:06 PM

It would be good to understand how exactly a frontier lab is approaching "removing the model's ability" to do a thing.

There's an ocean of difference between e.g. preventing the model from routing to something at the firewall level and just updating the prompt (especially given models' historically poor understanding of negative prompts, relatively speaking).

by _verandaguy

6/1/2026 at 10:25:07 PM

intuition says this isn't hard with SAEs. find the feature that corresponds to appscript code and train against it.

by sometimelurker

6/1/2026 at 5:48:10 AM

Oops I did it again ...

We're Sorry

by blitzar

6/1/2026 at 7:55:11 AM 

    ...
    I played with your heart
    Got lost in the game
    Oh, baby, baby
    Oops, you think I'm in love
    That I'm sent from above
    I'm not that innocent
-- Britney.

by chii

6/1/2026 at 8:07:03 AM

Wrong. Martin Max / Rami Yacoub.

by throw1234567891

6/1/2026 at 9:22:57 AM

Max Martin, not Martin Max.

by yakshaving_jgt

6/1/2026 at 9:37:27 AM

Blame google. Copy pasta.

by throw1234567891

6/1/2026 at 9:23:28 AM

nope.

by UqWBcuFx6NV4r

6/1/2026 at 9:38:07 AM

Well, yeah. Just google who wrote the song. Jezus.

by throw1234567891

6/1/2026 at 6:19:54 AM

>We appreciate the security research here

>it’s unfortunate this one slipped through a crack in our disclosure pipeline

>As we’re now aware of this report

This isn't the first time. https://x.com/PhilipTsukerman/status/1988634162773778501 https://x.com/_xpn_/status/1986382527817564437

What very likely happened here is you received good faith security research by email and you forced the researcher to submit through HackerOne or Bugcrowd or whatever, which mandates their compliance with Platform Terms and Disclosure Terms and Codes of Conduct and whatnot.

The SECURITY.md files in your GitHub repos only mention the email address. Can researchers like this one report issues via email and get a response, or not?

    May 08, 2026    PromptArmor discloses to OpenAI via email
    May 08, 2026    OpenAI sends an automated reply, confirming the intended reporting channel
    May 08, 2026    PromptArmor confirms email preference
    May 12, 2026    PromptArmor follows up
    May 18, 2026    PromptArmor follows up

by da_grift_shift

6/1/2026 at 11:07:30 AM

Is the disclosure pipeline monitored by chatgpt?

by jappgar

6/1/2026 at 7:33:57 AM

So if it wasn't for Hacker News and you randomly chancing upon it, your users would not have been protected against potential attacks? That's a pretty bad look, especially given that OpenAI ignored their initial disclosure via the channels the company provided.

That doesn't sound like a one-trillion-dollar company is supposed to operate, does it?

by altmanaltman

6/1/2026 at 11:32:29 AM

> That doesn't sound like a one-trillion-dollar company is supposed to operate, does it?

It’s not a one trillion dollar company anymore.

Anthropic won enterprise and Gemini is taking ChatGPTs consumer subscriptions month over month.

Morale at OAI is all time low right now.

by chrncirurp

6/1/2026 at 11:37:47 AM

How different are the big boy Gemini models to the one you unconsensually get to interact with when using Google? Cause I have a really hard time imagining using that for anything willingly, even if it was outright free. It's dumb as a rock, and it's been that way for several years now.

by perching_aix

6/1/2026 at 12:17:23 PM

If you're talking about the web ai overview thing, then the difference is day and night. Frontier gemini models are on par imo what you get with OpenAI and Anthropic models for most general tasks.

by altmanaltman

6/1/2026 at 3:20:48 PM

Let’s not discount DeepSeek in this space…workhorse, in many respects.

by YVoyiatzis

6/1/2026 at 12:21:33 PM

> Anthropic won enterprise

Depends on the enterprise, Mistral are pretty big here in EMEA because they're more trustworthy and you can self-host. Self-hosting ensures you can control costs better, fine tune the models for your own funky whatever (e.g. Ericsson fine tuned models to understand and run in their their custom silicon) but most of all, that your data remains where it needs to be.

My bet is that this kind of enterprise deployment with customisation is where the real big money in AI is (and not coding assistants), but it will mostly be spent by the big banks, industrial giants and SAPs of the world, who will want control.

by sofixa

6/1/2026 at 9:18:57 AM

When I reported to you, I received zero reaction. The security@ is a joke, you'll receive an AI word soup.

Enjoy your Ferrari though

by bflesch

6/1/2026 at 6:37:11 PM

Hah! Money != Worth .. is being proven as the stratification of society intensifies with more and more billionaires, fewer people in the middle class, and more in the lower income class.

by ncr100

6/1/2026 at 10:56:04 AM

I do imagine they get an insane amount of reports, i guess they haven’t figured out how to filter through them all

by k2xl

6/1/2026 at 11:09:10 AM

If only the had access to some system that could read and interpret text.

by jappgar

6/1/2026 at 11:14:28 AM

Who cares if they have problems from a situation they created

by Larrikin

6/1/2026 at 12:41:48 PM

Their customers do

by CryptoBanker

6/1/2026 at 10:45:25 AM

Or Honda Civic. Some folks like soft luxury. :)

I mean Warren Buffet eats at McDonalds every day!

by dabidab

6/1/2026 at 12:31:36 PM

No he doesn't

by barbazoo

6/1/2026 at 3:12:43 PM

I mean, he said as much on the documentary. Maybe not every day you don’t need to take the statement literally.

by dabidab

6/1/2026 at 3:27:48 PM

The hyperbole was probably on his side so I would put my money on it being much much closer to never than every day. He's smart so he invests in McDonald's, not eat it's unhealthy products. And I say that lovingly as someone who eats their food occasionally.

But also, who knows. Context matters, maybe he gets a salad with oil and vinegar dressing every day. Could totally be true!

by barbazoo

6/1/2026 at 3:37:31 PM

How does this slip through the cracks? This is exactly the type of stuff I constantly find at work. Even when I’m trying to actively not find it. I don’t understand how other devs ship a high risk feature then don't test it or think about it in any capacity other than their one happy path.

I keep trying to explain this to devs but there’s nothing out there except screaming over me about how great leetcode is or more recently it’s how great various AI uses are. Just completely ignorant isolated screaming to dismiss people like me putting in the work fix slop that steals all attention praise and career advancement or even getting through the slop hiring process.

This is directly caused by slop leetcode style hiring.

I have no doubt this finding is just the tip of the iceberg.

by bgro

6/1/2026 at 4:52:59 PM

Why should they test their output if they can ship it untested? Users will test for free! Pretty sure there are only incentives to push more lines of code, not to test those lines.

by ponector

6/1/2026 at 5:41:30 AM

> removing the model’s ability to generate Apps Script code

I use this feature with my agents on a daily basis so hopefully you develop a more surgical approach to security here and restore this

by user3939382

6/1/2026 at 2:17:10 PM

Not to mention how this does nothing about all the other ways an attacker could could exfiltrate data with default google sheets formulas like IMPORTHTML, IMPORTXML, or even HYPERLINK which will all generate http request.

by crisnoble

6/1/2026 at 6:34:59 PM

Does this ..

- "slipped through a crack in our disclosure pipeline"

.. mean something akin to, "DownDetector Itself Doesn't Detect that It Is Also Down"? or something like that?

Is there a category of security problems such as this? It seems fascinating to me, and severe.

by ncr100

6/1/2026 at 5:12:20 PM

>this one slipped through a crack

Oh, whoopsie!

by dogleash

6/1/2026 at 4:33:21 PM

[flagged]

by throw7

6/1/2026 at 7:02:15 AM

[dead]

by hansmayer

5/31/2026 at 10:20:18 PM

LLMs can live in the cloud, but all tools need to be (1) local, and (2) containerized. It's clear to me that just willy-nilly "running stuff" is going to blow things up eventually. Maybe folks don't know this, but even Codex installs random binaries on your PC. "Read this PDF" installs a pdf reader executable. Is it vetted? Where's it from? Is it a virus? Who knows, who cares. Model goes brrrr.

I'm working on a project that includes WASI containerization for local LLM workflows (which is a pretty tough problem), and I'm flabbergasted that Anthropic and OpenAI aren't more worried about these attack vectors. It feels like amateur hour.

by dvt

5/31/2026 at 11:01:26 PM

> I'm flabbergasted that Anthropic and OpenAI aren't more worried about these attack vectors

Yep. We tricked them both trivially with malicious fonts in Docx files. Documented it here: https://tritium.legal/blog/noroboto

I wonder if prompt injection (and the thousands of vectors for hiding injection attempts) is actually un solvable. Discussing it may be existential to the business model.

by piker

5/31/2026 at 11:08:56 PM

> I wonder if prompt injection (and the thousands of vectors for hiding injection attempts) is actually un solvable.

YES?!

This is not a secret. ALL context/prompt is instructions, there is no data. It is just unsolvable, period.

This is a fundamental architectural design concession; LLMs are this way as it enabled their training directly on materialscraped from the internet, rather than needing to spend trillions of dollars manually preparing separated instruction/data training material.

Defense against prompt injection is little more than running a regex to filter out "IGNORE PREVIOUS INSTRUCTIONS", which is fundamentally a hopeless approach because you cannot enumerate all possible prompt injections nor anticipate all glitch tokens.

by SlinkyOnStairs

6/1/2026 at 1:23:49 AM

> This is a fundamental architectural design concession; LLMs are this way as it enabled their training directly on materialscraped from the internet, rather than needing to spend trillions of dollars manually preparing separated instruction/data training material.

No, its even more fundamental than that: the entire goal of broad reasoning over input data makes it impossible to have a sharp instruction/data division.

The structured input that every modern chat-focussed model expects makes it very clear that they can be trained to distinguish different kinds of input, and some of those patterns now include different priority levels of instruction.

by dragonwriter

6/1/2026 at 12:26:45 AM

If only there was a language which allowed one to express instructions for a computer to execute which was nearly unambiguous, precise, deterministic, and containerized such that the computer would do exactly what you told it to.

...

Oh wait.

Yes, the above was referring to programming languages. Which is what prompts are, essentially. It's just a different (and more verbose) way of instructing the computer on what to do. It also has a solution space of infinity and is ambiguous enough that there is no way to secure it because there are infinite combinations of saying anything imaginable. All prompt injections do is prove this point, over and over and over again, and "prompting" an LLM is just reverse-engineering programming languages in the worst possible way. I suspect that we will eventually have no other choice but to revert to using programming languages because they are the only way to get the kind of protections that people are trying to come up with with all these containerization and virtualization systems (which inevitably fail).

by ethin

6/1/2026 at 5:40:48 AM

You make a fair and valid point about prompts, but you're ignoring the fact that writing code that's truly secure is also virtually impossible. The stack of layers that an attacker can target range from your own code, to library code (Heartbleed), container escape (maskedPaths abuse), OS (Dark Sword, Ghost Tap), hardware (Spectre, Rowhammer), etc. Security is really hard. Fortunately exploiting these things is also hard.

The belief that something is more likely to be secure because it's code instead of a prompt is likely only avoiding one particular type of attack. That's a win, but you probably shouldn't think of it as meaning your code is actually secure.

by onion2k

6/1/2026 at 9:10:16 AM

> ALL context/prompt is instructions, there is no data. It is just unsolvable, period.

That really isn't true. There's no law of physics preventing you from having separate data and instruction inputs to models. The model's transcript format generally distinguishes between prompts and instructions and tool output and such. This isn't a solved problem, and it's possible it's entire unsolvable, but it probably is possible (in general, not with current models) to reject prompt injection to several nines.

This is a lot like making the same statement about CPUs, "the von Neumann architecture doesn't distinguish between code and data so it's impossible to reject malicious instructions." There's actually a lot you can do to reject malicious instructions, you can prevent execution in certain pages, you can prevent certain privileged instructions from being executed in certain pages, you can employ stack cookies, et cetera. Do they prevent all exploitation in all circumstances? No. But each component does function in it's lane and it is possible to create programs with high (though not absolute) guarantees against unauthorized code execution by composing them.

Similarly, you could prevent certain tokens from appearing in the prompt portions of a transcript, you can have a model with multiple input heads only one of which is trusted, etc. I'm not saying those techniques will necessarily work, but it is more complex than "models can only possibly take a single and undifferentiated input stream".

by maxbond

6/1/2026 at 10:14:48 AM

A lot of the solutions in the CPU space involve things like memory allocation flags, NX bits, canaries, etc. that fire deterministically. Those things are fundamentally not applicable to LLMs, and without those things modern software would be in a vastly worse place.

You could imagine that there are things to change around LLM architecture that will improve its ability to reject prompt "injection", but I think it's fundamentally true that from an information theory perspective there's no bright line between "instruction" and "input data" possible.

by ealexhudson

6/1/2026 at 3:40:12 PM

Nondeterminism is a red herring. There is a bright line between instructions and data right now, in virtually every transcript format. That we have not succeeded in training an LLM to respect it to a very high degree doesn't imply it is impossible; that they are nondeterministic doesn't imply it is impossible; only that we won't succeed 100% of the time.

A cosmic ray (or rowhammer attack) could flip an X bit too, there isn't anything truly deterministic under the sun.

by maxbond

6/1/2026 at 4:58:21 AM

I don’t think we have the right mental models of LMM security yet. The lethal trifecta identifies many of the dangerous situations, but only describes the negative space of a solution.

Speculation: I think we must accept that prompt injection happens, and structure the security of the rest of the system around that. Data given to an LLM becomes an agent, so maybe we must give permissions to this data, instead of to the LLM. Not sure exactly how this would look like in practice!

by black_knight

6/1/2026 at 6:16:45 AM

I presume this is the reason you have setups like Claude Code's where it is essentially running a separate judge to determine if commands are safe.

by emodendroket

5/31/2026 at 11:40:21 PM

It’s a huge problem, but I’d caution against this absolutism — there may well be structure that can be created around and between LLMs and their outputs to enable the necessary segregation.

As a loose comparison, hardware bit errors happen probabilistically, yet they’re so rare that we can effectively ignore them in day-to-day use assuming no specialized application (e.g. defense, space, critical infrastructure).

LLMs aren’t there yet, but it’s entirely plausible that structures may can be developed to solve the problem, and those structures aren’t known or commonly conceived of in the present.

by bnjemian

6/1/2026 at 1:00:30 AM

> As a loose comparison, hardware bit errors happen probabilistically, yet they’re so rare that we can effectively ignore them in day-to-day use assuming no specialized application (e.g. defense, space, critical infrastructure)

The better comparison on bit errors would be e.g. rowhammer, an adversarial bit error. Which you absolutely can't ignore.

by dmoy

6/1/2026 at 5:33:30 AM

I believe it's likely that you could train an auditor model. Might even be doable in RL.

As in real life it wouldn't be any good at doing anything but it'd be able to see fault in others and deny actions.

by literalAardvark

6/1/2026 at 4:23:45 PM

depends what you mean by “solvable”. 0% attack success rate?

1. don’t use AI/ML.

    *f*(x) -> y
literally what’s happened here, they’ve turned it off short term. don’t use AI/ML and prompt injection can’t happen. use something else for f.

2. don’t allow untrusted/malicious input

    f(*x*) -> y
don’t allow bad x and you won’t get bad y. unfortunately models are designed to take an x, and figuring out every bad x is hard. the input space is massive and dynamic (variable length input sequences which are contextually variable too).

because figuring out the full space of bad xs is non-trivial, you’re left with doing stuff with known bad xs. which means cat and mouse game when new things pop up.

unless someone figures out how to map the full X space to the Y space, or we have infinite monkeys figure it out for us brute force — in which case we’re not doing machine learning any more.

3. don’t allow dangerous outputs

    f(x) -> *y*
if you don’t provide a mechanism for “do bad thing”, then the bad thing can’t happen. this doesn’t actually solve prompt injection, it just makes outcomes less impactful (see note). most enterprises have had to spend the last year or two figuring this out.

(old) Apple Siri solved for this by forcing users to remember specific “commands” it would run after doing TTS. can’t make Siri delete your phone contacts if you don’t create a Siri command to delete phone contacts.

—

it will be a cat and mouse game so long as people keep using AI/ML and keep passing untrusted input to the systems. best thing people can do is block dangerous things from happening. at least then it’s no going to wipe your prod DB.

unfortunately that doesn’t fit the “model goes brrrr” and “all devs will now be unemployed” narratives.

(note) denial of service attacks are still a thing here. make every output be “not the thing user wanted”.

by dijksterhuis

5/31/2026 at 11:09:52 PM

lakera is trying to solve it, but its going to be a battle similar to virus and antivirus in the past.

by busssard

5/31/2026 at 11:33:10 PM

> I'm flabbergasted that Anthropic and OpenAI aren't more worried about these attack vectors. It feels like amateur hour

I share your concern but it's not a correct characterisation to say they are not taking it seriously:

https://www.anthropic.com/engineering/how-we-contain-claude

My concern is people aren't even addressing this at the right level. People are currently thinking at the level of "how do I build a VM to contain this one agent" when this is actually a "design a whole new OS" level problem.

by zmmmmm

6/1/2026 at 11:04:23 AM

Anthropic, as much as I think they are the soundest of the AI labs out there, still has a massive incentive to push things out that aren't saftey-vetted to the level we expect. They are very willing to "move fast and leave holes", to paraphrase M.Z. Hell, they leaked their own source code!

by cseleborg

5/31/2026 at 10:43:53 PM

I share your worries.

Unfortunately, this may be akin to the situation of "The market can stay irrational longer than you can stay solvent."

by CoastalCoder

5/31/2026 at 11:31:00 PM

Does containerization help much here? If it's a code tool then presumably it needs access to your code files (read / write). Maybe there are use cases for it of course.

by osigurdson

5/31/2026 at 11:45:17 PM

WASI provides a very nice mental model where you can mount, e.g., /input, as read-only, and where every mutation is saved in /output or what-not. At least that's my favorite contract: input files remain untouched, but we can copy them and do whatever we want with them in /scratch or /output (which the user can later investigate and make sure nothing went horribly wrong while still having backups).

by dvt

6/1/2026 at 9:18:19 AM

Of course. My agentic coding containers can only access the internet through a proxy, and I use whitelists to limit from where they can send/receive data. It's annoying in the beginning as the whitelist grows, but in the end really useful information for the agent usually comes from a very limited amount of domains.

by pbmonster

6/1/2026 at 12:57:22 AM

Got a link to your project? I'm working on something that could make use of something like this.

by int3trap

5/31/2026 at 10:29:20 PM

>"Read this PDF" installs a pdf reader executable.

How does this work regarding Macos notarization btw?

by torben-friis

5/31/2026 at 10:37:00 PM

I was actually curious, on my Mac, it uses `gs -q -sDEVICE=txtwrite -o output.txt input.pdf` (not sure why I have Ghostscript installed, maybe Adobe?) to read a PDF, and on my PC it just rawdogs `pdftotext`.

by dvt

5/31/2026 at 10:33:16 PM

What does notarization have to do with that? You or ChatGPT or whatever download a signed and already notarized binary.

by fragmede

5/31/2026 at 10:36:37 PM

That was kind of my question, whether it was restricted to downloading notarized apps (which is at least something) or whether they were circumventing that somehow.

by torben-friis

5/31/2026 at 10:53:54 PM

Locally compiled code doesn't need to be notarized, if that's what you're asking. Or a dose of xattr -d.

by fragmede

6/1/2026 at 9:26:57 AM

They’ll all be offering to run from the cloud with the next 3-4 months.

by nelox

5/31/2026 at 11:30:11 PM

Local and containerised, without internet access.

by HPsquared

5/31/2026 at 11:35:27 PM

effectively, that means it's a VM not a container

because sharing the kernel ultimately means all the devices come along for the ride which give all kinds of fancy ways to communicate with the outside world - network is just the start

I think micro-VMs are the future here, but they need heavy adaptation from their current usage.

by zmmmmm

6/1/2026 at 12:15:36 PM

[dead]

by keynha

6/1/2026 at 6:55:58 AM

> I'm flabbergasted that Anthropic and OpenAI aren't more worried about these attack vectors

They are well aware of the issues and there is no fix for it. But there is too much money riding on this...

> I'm working on a project that includes WASI containerization for local LLM workflows

I am working on something similar. If you are open to connecting, what would be a good email to catch with you on?

by csomar

6/1/2026 at 7:09:22 PM

Feel free to reach out at d(at)dvt(dot)name—happy to connect!

by dvt

5/31/2026 at 10:37:03 PM

> I'm flabbergasted that Anthropic and OpenAI aren't more worried about these attack vectors. It feels like amateur hour.

"Move fast. Break things." on steroids.

by bossyTeacher

6/1/2026 at 12:03:15 PM

corr: "Move fast. Break things [in society]. Make bank. Buy politicians and pardons."

by yubblegum

5/31/2026 at 10:27:29 PM

>This vulnerability was responsibly disclosed to OpenAI. Despite multiple follow-ups, we received no communication beyond an automated reply to our initial disclosure.

Well, that’s not cute.

by xmcp123

6/1/2026 at 5:42:12 AM

Someone in the comments claims to be from OpenAI and is giving some updates. This also proves that until social media puts pressure on companies, they won't care. Nothing new to see here.

by system2

6/1/2026 at 6:01:36 AM

Just embarrassing behavior from OpenAI. Is it laziness? Why does it take public ridicule for these companies to get a shit.

by replwoacause

6/1/2026 at 6:58:28 AM

They are hype machines. They are driven by that and only care about that. That's why they cared once this went public and viral.

by csomar

6/1/2026 at 12:36:57 PM

>responsibly disclosed

Isn't this a double plus good phrase? What makes this more responsible? Reasoning about first order effects of different disclosure models? But what if someone uses higher order reasoning and critical thinking to reach a conclusion that other disclosure models are better for the average user and the long term health of the industry, even if they are worse in any individual case. A difference in the security culture incentivized by different disclosure patterns. Why does this one win the name of responsible while other alternatives, which have never been proven to be worse, are automatically marked as irresponsible?

Reminds me a bit of the concept of identity theft, as a way to say that even though the bank (or other creditor) was the one who had money taken from them, it is actually the random person not involved in the transaction who is the victim and has to hold the debt until the issue is resolved.

by SkyBelow

6/1/2026 at 12:58:48 PM

Could you elaborate on what other disclosure models you're referring to? I can't imagine something being "more responsible" for the public than privately notifying the owning party to give them time to fix the issue, before notifying the rest of the world (including malicious actors) about it.

by mattstir

6/1/2026 at 5:46:18 PM

Didn't the original authors end up leaking this before OpenAI fixed it? They gave them a chance, but then had to decide between staying fully silent or publishing the details despite malicious actors learning about it before it was fixed or leaving users in the dark. They chose it was better to warn users and inform malicious actors despite it not being fixed.

>This vulnerability was responsibly disclosed to OpenAI. Despite multiple follow-ups, we received no communication beyond an automated reply to our initial disclosure. OpenAI's documentation fails to describe sensitive capabilities granted to the model (e.g., running privileged scripts) or risks of model manipulation via indirect prompt injection, instead focusing solely on functional limitations and data-handling concerns. As such, we are publishing our findings to enable informed decision-making regarding the risk surface.

That very last sentence was considered justification of putting this knowledge into the wild when OpenAI refused to fix it. So, if we consider it justified with a delay, then we are saying it is acceptable (it is "responsible") to give the information to malicious actors as long as you tried to warn the right party first.

Compare that to two alternatives. Alternative 1 is never disclosing it to the public until fixed. Saying it is never acceptable to let malicious actors know until it is no longer a concern, even though this will mean users are kept in the dark about the risk.

Alternative 2 is to reduce that timeline to 0. Say that users are immediately warned, despite the risks of making it known to bad actors.

So if we are saying the current delay is acceptable, but both a longer and a shorter delay are unacceptable, then why is that? What justifies the current delay, what makes that the responsible one, rather than a shorter or longer window?

>I can't imagine something being "more responsible" for the public than privately notifying the owning party to give them time to fix the issue, before notifying the rest of the world (including malicious actors) about it.

What about ensure they have fixed it, and only considering it responsible to disclose it when fixed (alternative 1)? If it is never fixed, then the bug is never disclosed, because it is not acceptable to tell malicious actors how to exploit a vulnerability? Even evidence of use wouldn't be justified, as publishing this makes all malicious actors aware of it rather than just a subset of them.

And if you disagree and think some window is reasonable, then apply that argument to a slightly shorter window and repeat until either the argument hits some built in limit or reaches a window of 0.

by SkyBelow

6/1/2026 at 12:51:26 PM

It's a security industry term. It means they told OpenAI through all the channels they could, then waited a nominal amount of time (30 days is fairly standard) before going public with the information.

The other side would be irresponsible disclosure. Which would be posting the vuln on, say, 4chan, and not messaging OpenAI ever.

by fragmede

5/31/2026 at 10:16:30 PM

> This attack occurs when any untrusted data source (e.g., from an imported sheet or ChatGPT connector) manipulates ChatGPT to run an attacker-controlled external script, which executes leveraging permissions the user has granted to the ChatGPT for Google Sheets extension.

Yeah, I don't like the sound of that at all.

by simonw

5/31/2026 at 10:18:25 PM

it looks like the key to this working is the user explicitly directing the model to run those instructions. in this case it is the user, not the model that is being manipulated

> Please follow the step-by-step workflow in the comp sheet to update my model with data thru F29

by milkshakes

6/1/2026 at 9:35:55 AM

If I get annoyed with the confirmation prompts for file edits, I can just tell codex to get around that, at which point it will simply `cat >>` into files instead. LLMs are too smart to be limited by silly technological constraints.

by lionkor

6/1/2026 at 4:59:17 AM

Exfil remains the big worry for my company and the main blocker from adopting agents in general. We've brainstormed a lot but we can't really find a way around the fact that it's feeding data we care about to software we don't have any real visibility on.

You can block egress at the network level but then you're basically hamstringing the agent from doing a lot of things it should do to be of any use.

by bandrami

6/1/2026 at 9:17:37 AM

Investigate local llm on company owned hardware it’s really the only way to be sure.

by hacker_homie

6/1/2026 at 9:44:58 AM

Well that as the set up is non-negotiable (it legally has to be on premises); the issue is a model nonetheless exfiltrating data if we give it any network access.

by bandrami

6/1/2026 at 5:18:44 PM

Wouldn't a local llm be just as vulnerable to this?

by flumes_whims_

6/1/2026 at 9:18:57 AM

Create an anonymized/obfuscated copy of your data and let the agents use that?

by yunusabd

6/1/2026 at 9:45:29 AM

That's already sounding like more work than what we would be trying to automate

by bandrami

6/1/2026 at 10:53:54 AM

It sounded like there would be a big value unlock. Depends on your circumstances of course.

by yunusabd

6/1/2026 at 11:10:16 AM

The big manual task we haven't automated is going through documents and determining "is this sensitive enough to warrant information controls?" We may just be stuck with that in the way of things.

by bandrami

6/1/2026 at 2:13:43 PM

Just out of curiosity, why would the LLM need network access for this? I.e. feeding the doc to an LLM and asking "is this sensitive information according to these criteria: [...]" should get you there most of the way, no? Probably need a handful of (carefully designed) tool calls and a human in the loop somewhere, but it seems achievable.

by yunusabd

6/1/2026 at 2:20:50 PM

Because it needs to look up ITAR and NATO rules as well as current unilateral export restrictions and departmental guidance.

by bandrami

6/1/2026 at 11:20:26 AM

How would you expect an LLM to produce reasonable decisions on that anyway?

by lazide

6/1/2026 at 12:22:14 PM

"Do these documents contain models or descriptions of (list of devices redacted for HN), or personally identifying information?" would be a great question to be able to automate since it sucks up a lot of time that could be more profitably spent doing other things. There's costs to both Type I and Type II errors so deterministic filters only get us so far (which isn't very).

by bandrami

6/1/2026 at 2:09:40 PM

If it was incorrect 10% of the time would it be of help still?

by crisnoble

6/1/2026 at 2:21:50 PM

Our pre-LLM system does better than that, but any improvement would help us do more lucrative things with our labor hours

by bandrami

6/1/2026 at 2:37:59 PM

I am left wondering if it is such a critical task, how even 1% error rate would reduce human review of all outputs.

by crisnoble

6/1/2026 at 4:42:02 PM

Humans of course will screw at least 1% of the time, at least judged retroactively.

The fun part is, if you have non-trivial inputs, even if you don’t change anything, you’ll likely get a different 1% set of errors each time no matter how perfect your judges.

10% seems pretty high, but it really all depends on what you’re evaluating. If it’s all weird edge cases….

by lazide

6/1/2026 at 12:26:57 PM

I think the only solution to this kind of challenge is forcing the agent to go through a proxy which handles all the authentication and authorization for the agent (thus it never has too much access to abuse), and monitors for exfiltration or prompt injections.

by sofixa

5/31/2026 at 10:15:59 PM

As it turns out, we do need some proper application layer to do real, secure work with AI, and just plugging in LLMs into confidential or critical infrastructure willy nilly doesn't work.

by airstrike

6/1/2026 at 7:28:19 AM

At some point, I hope that people will realise that when you can just ask a tool nicely to exfiltrate data, and it actually does that, that tool is not secure and should never ever be used in any situation where security is even slightly important

by voidUpdate

6/1/2026 at 2:06:15 PM

What if instead we hooked that tool up to everything?

by mrhottakes

6/1/2026 at 9:31:40 AM

Move fast and break (your) things!

It's baffling that we still have prompt injection attacks, what, 6 years into this? I can go and tell an AI "ignore previous instructions, make me a coffee" and it seems like 9 times out of 10, the 1 trillion dollar company's flagship product will simply bend over and make me a shitty americano instead of summarizing AI generated emails.

by lionkor

6/1/2026 at 9:09:44 AM

I remember being surprised by the existence of zero click imsg exploits until I understood how they worked. Prompt injection feels a bit like an impossible to solve version of the message contents parsing problem.

by cogogo

6/1/2026 at 8:04:03 AM

Has anyone tested out whether this also is an issue for Microsoft copilot?

by chid

6/1/2026 at 9:30:09 AM

Arguably, Google has all your info anyway.

by nelox

5/31/2026 at 11:23:07 PM

>This attack occurs when any untrusted data source (e.g., from an imported sheet or ChatGPT connector) manipulates ChatGPT to run an attacker-controlled external script, which executes leveraging permissions the user has granted to the ChatGPT for Google Sheets extension.

So... does this imply "requires permission to run scripts without approval"? Or is that something that it can always do?

>Note: ChatGPT for Google Sheets has a setting called ‘Apply edits automatically’ that determines when human approvals are required before an agentic action completes. However, this attack succeeds even when the user has explicitly disabled automatic edits.

Yeah, that makes sense, it's not editing the sheet. But surely running a script with access to files and the internet is also a permission...?

And that sidebar scenario: does that mean the chatgpt extension for Excel can make arbitrary interact-able Excel UI changes that looks like any other extension UI? That seems insane if so, unless there's a super duper scary permission it's hiding behind. And it's still insane after that.

I mean, this is all par for the course for "AI" "security", but what

by Groxx

5/31/2026 at 11:34:58 PM

How long did it take from the first macro virus until the industry accepted that "we can't have nice things (at this cost to security)" - macros were defaulted to off everywhere?

How long until the industry accept the risk LLMs pose with "prompt injection"?

by e12e

6/1/2026 at 6:54:34 AM

Well, people used MS-DOS which had basically no security model at all for at least 10 years. Most viruses were benign, but it was almost trivial to simply wipe the entire hard disk. People generally didn't care, and made backups.

Things have become a bit more complicated now that machines are connected all the time, and the risk of infection is no longer limited to physically inserting a floppy disk into a machine.

I suspect that the solution is not so much in trying to make our current systems secure, but to make disconnection more practical.

by smokel

6/1/2026 at 12:02:26 PM

The "S" in AI stands for security.

by AlexandrB

5/31/2026 at 10:14:59 PM

Turns out that some of the people building the software with AI have no clue how to secure them or even know it is riddled with security holes added by the AI.

Pure vibes.

by rvz

5/31/2026 at 10:19:15 PM

I don't think anyone is surprised by it. People are not vibe-coding zombies... yet.

It's a matter of one trillion-dollar company not falling behind another trillion-dollar company. They know what they are doing and are OK with it.

by grim_io

5/31/2026 at 10:28:48 PM

moving all of the fast and breaking all of the things

by cheschire

5/31/2026 at 10:16:45 PM

Even the people that do know better are so lazy now because of LLMs these things are happening at a rapid clip.The only thing that matters now is speed and chasing the dopamine dragon of pseudo productivity.

by dakolli

6/1/2026 at 8:25:31 AM

[flagged]

by AIOperator2026

6/1/2026 at 8:30:12 AM

[flagged]

by zenai666

6/1/2026 at 5:07:50 AM

[flagged]

by hanzeweiasa

6/1/2026 at 5:31:21 AM

[flagged]

by Songjinhao

5/31/2026 at 11:36:29 PM

[dead]

by ashahin

6/1/2026 at 4:39:41 AM

[dead]

by davidjw89

6/1/2026 at 7:04:04 AM

[dead]

by hansmayer

6/1/2026 at 9:18:59 AM

[dead]

by Ozzie-D

5/31/2026 at 10:09:43 PM

So is your business model to expose AI security issues and then sell the solution?

by jonplackett

5/31/2026 at 11:11:23 PM

Isn’t that what anyone does who is selling a solution to a problem that already exists?

by nkrisc

5/31/2026 at 10:22:06 PM

What would be the alternative business model?

by fg137

5/31/2026 at 10:15:09 PM

Is that not every cyber consultancy? What's wrong with that?

by dakolli

5/31/2026 at 11:00:30 PM

AI is creating jobs!

by fragmede