ChatGPT Operator 提示注入攻击实测与防御分析
安全研究者 Johann Rehberger 实测发现,ChatGPT Operator 可被网页上的提示注入劫持,先跳转到用户已登录的站点读取邮箱、住址、电话等个人信息,再粘贴进第三方页面直接外传,且无需点击提交按钮。他在 Booking.com、The Guardian、YC Hacker News 等站点上均复现成功,并观察到 OpenAI 的缓解措施包括用户监控、对话内确认请求和提示注入监控,但这些防御是概率性的,通常在危险动作发生前才触发。作者约三周前已向 OpenAI 披露相关绕过细节,并表示该攻击场景目前已不再生效。
ChatGPT Operator is a research preview agent from OpenAI that lets ChatGPT use a web browser. It uses vision and reasoning abilities to complete tasks like researching topics, booking travel, ordering groceries, or as this post will show, steal your data! Currently, it’s only available for ChatGPT Pro users. I decided to invest $200 for one month to try it out. Risks and Threats OpenAI highlights three risk categories in their Operator System Card: User might be misaligned (the user asks for a h
匹配字段正文
