Image by Tumisu, from Pixabay
ChatGPT’s Memory Vulnerability: A Potential Security Risk
- Written by Kiara Fabbri Former Tech News Writer
- Fact-Checked by Justyn Newman Former Lead Cybersecurity Editor
In a Rush? Here are the Quick Facts!
- Identified a vulnerability in ChatGPT’s long-term memory feature.
- The flaw allows prompt injection from untrusted sources like emails.
- ChatGPT can store false information based on manipulated memory inputs.
ArsTechnica (AT) reported on Tuesday a study showcasing a vulnerability in OpenAI’s ChatGPT that allowed attackers to manipulate users’ long-term memories by simply having the AI view a malicious web link, which then sent all interactions with ChatGPT to the attacker’s website.
Security researcher Johann Rehberger demonstrated this flaw through a Proof of Concept (PoC), showing how the vulnerability could be exploited to exfiltrate data from ChatGPT’s long-term memory.
Rehberger discovered that ChatGPT’s long-term memory feature was vulnerable. This feature has been widely available since September.
The vulnerability involves a technique known as “prompt injection.” This technique causes large language models (LLMs) like ChatGPT to follow instructions embedded in untrusted sources, such as emails or websites.
The PoC exploit specifically targeted the ChatGPT macOS app, where an attacker could host a malicious image on a web link and instruct the AI to view it.
Once the link was accessed, all interactions with ChatGPT were transmitted to the attacker’s server.
According to AT, Rehberger found this flaw in May, shortly after OpenAI began testing the memory feature, which stores user details such as age, gender, and beliefs for use in future interactions.
Although he privately reported the vulnerability, OpenAI initially classified it as a “safety issue” and closed the report.
In June, Rehberger submitted a follow-up disclosure, including the PoC exploit that enabled continuous exfiltration of user input to a remote server, prompting OpenAI engineers to issue a partial fix.
While the recent fix prevents this specific method of data exfiltration, Rehberger warns that prompt injections can still manipulate the memory tool to store false information planted by attackers.
Users are advised to monitor their stored memories for suspicious or incorrect entries and regularly review their settings.
OpenAI has provided guidelines for managing and deleting memories or disabling the memory feature entirely.
The company has yet to respond to inquiries about broader measures to prevent similar attacks in the future.
Rehberger’s findings highlight the potential risks of long-term memory in AI systems, particularly when vulnerable to prompt injections and manipulation.
Image by Burst, from Negative Space
TikTok Music To Shut Down Worldwide In November
- Written by Kiara Fabbri Former Tech News Writer
- Fact-Checked by Justyn Newman Former Lead Cybersecurity Editor
In a Rush? Here are the Quick Facts!
- TikTok Music will shut down globally on November 28, 2024.
- Subscribers must transfer playlists and request refunds before the shutdown.
- TikTok Music users can no longer re-subscribe after September 24, 2024.
ByteDance, the parent company of TikTok, has announced today the global shutdown of its music streaming service, TikTok Music. According to the notice on the service’s website, TikTok Music will cease operations on November 28, 2024.
“We are sorry to inform you that TikTok Music will be closing on 28 November 2024,” the notice read, marking the end of the platform’s attempt at music streaming.
The decision to shutter TikTok Music comes amidst a strained relationship between TikTok and the music industry. TechCrunch (TC) notes that the service has faced ongoing challenges with record labels.
Earlier this year, Universal Music Group (UMG) pulled its entire catalog from TikTok following disputes over royalty payments.
The move temporarily caused videos on the app to appear without audio, highlighting TikTok’s critical role in artist discovery and song promotion, as noted by TC.
The Wall Street Journal (WSJ) reported that TikTok videos have been responsible for launching new artists and hits, a dynamic that has complicated its negotiations with major labels like UMG.
In response to UMG’s withdrawal, TikTok criticized the company for promoting a “false narrative.” as reported by TC.
Despite the tension, a truce was reached in March 2024, and by May, both parties signed a deal to reinstate UMG’s catalog on TikTok, as noted by WSJ.
The agreement included provisions to raise artist royalties and enhance protections against artificial intelligence misuse.
In parallel, TikTok is entangled in legal battles over potentially being banned in the U.S . According to TC, these legal issues could have influenced ByteDance’s decision to shut down TikTok Music, hindering its ability to expand into key markets like the U.S.
The closure of TikTok Music underscores the complex relationship between social media platforms and the music industry, where platforms like TikTok wield growing influence over artist visibility and revenue generation.
