Connect with us

Technology

How a researcher hacked ChatGPT's memory to expose a major security flaw

Published

on

How a researcher hacked ChatGPT's memory to expose a major security flaw

ChatGPT is an amazing tool, and its developer, OpenAI, keeps adding new features from time to time.

Recently, the company introduced a new memory feature in ChatGPT, which essentially enables it to remember things about you. For example, it can recall your age, gender, philosophical beliefs and pretty much anything else. 

These memories are meant to remain private, but a researcher recently demonstrated how ChatGPT’s artificial intelligence memory features can be manipulated, raising questions about privacy and security.

I’M GIVING AWAY A $500 GIFT CARD FOR THE HOLIDAYS

Advertisement

ChatGPT introduction screen. (Kurt “CyberGuy” Knutsson)

What is ChatGPT’s Memory feature?

ChatGPT’s memory feature is designed to make the chatbot more personal to you. It remembers information that might be useful for future conversations and tailors responses based on that information, even if you open a different chat. For example, if you mention that you’re vegetarian, the next time you ask for recipes, it will provide only vegetarian options. 

WHAT IS ARTIFICIAL INTELLIGENCE (AI)?

You can also train it to remember specific details about you, such as saying, “Remember that I like to watch classic movies.” In future interactions, it will tailor recommendations accordingly. You have control over ChatGPT’s memory. You can reset it, clear specific memories or all memories, or turn this feature off entirely in your settings.

ChatGPT hack 2

A prompt on ChatGPT. (Kurt “CyberGuy” Knutsson)

WINDOWS FLAW LETS HACKERS SNEAK INTO YOUR PC OVER WI-FI

Advertisement

The security vulnerability in ChatGPT

As reported by Arstechnica, security researcher Johann Rehberger found that it’s possible to trick the AI into remembering false information through a method called indirect prompt injection. This means the AI can be manipulated into accepting instructions from unreliable sources like emails or blog posts.

For instance, Rehberger demonstrated that he could trick ChatGPT into believing a certain user was 102 years old, lived in a fictional place called the Matrix and thought the Earth was flat. After the AI accepts this made-up information, it will carry it over to all future chats with that user. These false memories could be implanted by using tools like Google Drive or Microsoft OneDrive to store files, upload images or even browse a site like Bing — all of which could be manipulated by a hacker.

Rehberger submitted a follow-up report that included a proof of concept, demonstrating how he could exploit the flaw in the ChatGPT app for macOS. He showed that by tricking the AI into opening a web link containing a malicious image, he could make it send everything a user typed and all the AI’s responses to a server he controlled. This meant that if an attacker could manipulate the AI in this way, they could monitor all conversations between the user and ChatGPT.

Rehberger’s proof-of-concept exploit demonstrated that the vulnerability could be used to exfiltrate all user input in perpetuity. The attack isn’t possible through the ChatGPT web interface, thanks to an API OpenAI rolled out last year. However, it was still possible through the ChatGPT app for macOS.

When Rehberger privately reported the finding to OpenAI in May, the company took it seriously and mitigated this issue by ensuring that the model doesn’t follow any links generated within its own responses, like those involving memory and similar features. 

Advertisement

HOW TO REMOVE YOUR PRIVATE DATA FROM THE INTERNET

ChatGPT hack 3

Johann Rehberger’s ChatGPT conversation. (Johann Rehberger)

CYBER SCAMMERS USE AI TO MANIPULATE GOOGLE SEARCH RESULTS

OpenAI’s response

After Rehberger shared his proof of concept, OpenAI engineers took action and released a patch to address this vulnerability. They released a new version of the ChatGPT macOS application (version 1.2024.247) that encrypts conversations and fixes the security flaw.

So, while OpenAI has taken steps to address the immediate security flaw, there are still potential vulnerabilities related to memory manipulation and the need for ongoing vigilance in using AI tools with memory features. The incident underscores the evolving nature of security challenges in AI systems.

The company says, “It’s important to note that prompt injection in large language models is an area of ongoing research. As new techniques emerge, we address them at the model layer via instruction hierarchy or application-layer defenses like the ones mentioned.”

Advertisement

How do I disable ChatGPT memory?

If you’re not cool with ChatGPT keeping stuff about you or the chance that it could let a bad actor access your data, you can just turn off this feature in the settings.

  • Open the ChatGPT app or website on your computer or smartphone.
  • Click on the profile icon in the top right corner of the screen.
  • Go to Settings and then select Personalization.
  • Switch the Memory option off, and you’re all set.

This disables ChatGPT’s ability to retain information between conversations, giving you full control over what it remembers or forgets.

ChatGPT hack 4

A man using ChatGPT on his laptop  (Kurt “CyberGuy” Knutsson)

DON’T LET SNOOPS NEARBY LISTEN TO YOUR VOICEMAIL WITH THIS QUICK TIP

Cybersecurity best practices: Protecting your data in the age of AI

As AI technologies like ChatGPT become more prevalent, it’s crucial to adhere to cybersecurity best practices to protect your personal information. Here are some tips for enhancing your cybersecurity:

1. Regularly review privacy settings: Stay informed about what data is being collected. Periodically check and adjust privacy settings on AI platforms like ChatGPT and others to ensure you’re only sharing information you’re comfortable with.

Advertisement

2. Be cautious about sharing sensitive information: Less is more when it comes to personal data. Avoid disclosing sensitive details such as your full name, address, or financial information in conversations with AI.

3. Use strong, unique passwords: Create passwords that are at least 12 characters long, combining letters, numbers, and symbols, and avoid reusing them across different accounts. Consider using a password manager to generate and store complex passwords.

4. Enable two-factor authentication (2FA): Add an extra layer of security to your ChatGPT and other AI accounts. By requiring a second form of verification, such as a text message code, you significantly reduce the risk of unauthorized access.

5. Keep software and applications up to date: Stay ahead of vulnerabilities. Regular updates often include security patches that protect against newly discovered threats, so enable automatic updates whenever possible.

6. Have strong antivirus software:  In an age where AI is everywhere, protecting your data from cyber threats is more important than ever. Adding strong antivirus software to your devices adds a critical layer of protection. The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. Get my picks for the best 2024 antivirus protection winners for your Windows, Mac, Android & iOS devices.

Advertisement

7. Regularly monitor your accounts: Catch issues early. Frequently check bank statements and online accounts for any unusual activity, which can help you identify potential breaches quickly. 

Kurt’s key takeaways

As AI tools like ChatGPT get smarter and more personal, it’s pretty interesting to think about how they can tailor conversations to us. But, as Johann Rehberger’s findings remind us, there are some real risks involved, especially when it comes to privacy and security. While OpenAI is able to mitigate these issues as they arise, it also shows that we need to keep a close eye on how these features work. It’s all about finding that sweet spot between innovation and keeping our data safe.

What are your thoughts on AI remembering personal details—do you find it helpful, or does it raise privacy concerns for you? Let us know by writing us at Cyberguy.com/Contact

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter

Advertisement

Ask Kurt a question or let us know what stories you’d like us to cover.

Follow Kurt on his social channels:

Answers to the most-asked CyberGuy questions:

New from Kurt:

Copyright 2024 CyberGuy.com. All rights reserved.

Advertisement

Continue Reading
Advertisement
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Technology

This digital D&D watch lets you roll a fireball from your wrist

Published

on

This digital D&D watch lets you roll a fireball from your wrist

Dice hoarding is a common hobby among Dungeons and Dragons players, but I’m betting most won’t have a digital watch in their collection. Alongside displaying the time, day, and date, the Timestop D-20 includes all the dice-rolling features you need to play tabletop roleplaying games directly from your wrist at the push of a button.

The watch allows the wearer to digitally roll a 4-, 6-, 8-, 10-, 12-, 20-, or 100-sided dice, alongside “Advanced Combat” features such as rolling up to 12 dice at once, and D20s with advantage or disadvantage (a fancy way of rolling two dice and taking either the higher or lower results). It’ll also display specific icons when a D20 rolls a 1 or a 20 — known as a “critical failure” or “critical success” respectively in D&D.

“We wanted a fun animation while rolling, but also an overall subdued look so you could ‘take the game with you’ and even wear the watch at the office,” Timestop says in its blog describing the design process. “We included day and date complications with a perpetual calendar so it was still a practical timepiece.”

Pricing starts at $99 and is available in three colors: black, orange, and stainless steel. Shipping starts next year, with stock available for delivery in either January or February. 

One feature you won’t find on the Timestop D-20 is an alarm, because alarms “aren’t fun,” according to its creator. Otherwise, it’s water-resistant, features a backlit LCD display, and uses a replaceable coin cell battery that can last up to three years with “typical use.” I’m not sure how many fireball spells would be considered typical, but it certainly offers a more unique way to play than traditional dice or digital dice-rolling apps.

Advertisement
Continue Reading

Technology

Honda has a plan to build solid-state batteries for EVs

Published

on

Honda has a plan to build solid-state batteries for EVs

Honda set up a demonstration facility in Japan to show off its plans to mass-produce solid-state batteries at lower costs, which could be crucial to unlocking higher-range, longer-lasting electric vehicles for the future.

Solid-state batteries have been elusive for many companies due to the complexity of scaling up production. The technology swaps out the liquid electrolytes found in current lithium-ion batteries with dry conductive materials, promising higher energy density and longer lifespans. But it will require a whole new production process to be successful.

Roll pressing of cathode for solid-state batteries.
Image: Honda

Honda says it is accelerating research at its new 27,000 square-meter demo facility set up in Sakura City, Japan, and is shortening the time required to make a single unit. The site has full-scale equipment that is split between three buildings: the first for cathode formation and cell assembly; the second for anode formation; and the third for electrolyte activation and module assembly.

The plan includes using a continuous inline mixer that Honda says is “three times faster” than typical cell batch processing. Honda plans to make batteries on this line in January.

Advertisement

Honda is readying its solid-state tech for mass production in the second half of the 2020s. The company’s CEO Toshihiro Mibe has eluded that solid-state batteries will also be the key to unlocking cheaper EVs.

Continue Reading

Technology

How your browser is spying on you: Hidden dangers lurking behind every click

Published

on

How your browser is spying on you: Hidden dangers lurking behind every click

A browser is one of the most popular apps we use. It’s the gateway between the internet and its users, translating raw code into something we perceive as a web page and allowing us to interact with the web. It’s safe to say that anyone who uses the internet uses a web browser. 

But while this tool is extremely useful, it can also be equally dangerous. For example, clicking malicious links can redirect you to harmful websites that either steal personal information or infect your device with malware.

If you use a search engine like Google through Chrome, it can collect data on your searches, browsing history and even your location (if location services are enabled). Most browsers also use cookies, small files that store information about your online behavior. Let’s discuss the risks associated with web browsers and how to stay safe.

I’M GIVING AWAY A $500 GIFT CARD FOR THE HOLIDAYS

A person conducting a Google search on their laptop (Kurt “CyberGuy” Knutsson)

Advertisement

How a browser doubles as spyware

Browsers are much more than simple tools to navigate the web. They are, in many ways, tools for surveillance. While they help you access websites and services, they also track your every move online to feed the ever-hungry advertising industry.

First off, most browsers collect data about your searches, browsing habits and even your location. This data isn’t just stored to “improve your experience,” it’s used to create a detailed profile of you, which is then shared with advertisers who target you with personalized ads. 

Google Chrome, for example, is notorious for tracking your activity. As you browse, it feeds data to Google’s advertising engine, allowing it to serve highly targeted ads based on your behavior. This includes everything from your search history to the websites you visit, even down to the smallest detail, like how long you stay on a page​.

“Google may share information about you with advertisers, business partners, sponsors, and other third parties,” Google boldly mentions on its privacy policy page.

Browsers also use cookies to keep tabs on you. These cookies track your activity across different sites, even after you’ve left a site. This means that ads you saw on one website might follow you across others, creating a persistent digital footprint. And while cookies can be blocked or deleted, many websites rely on them to function, making it hard to escape this kind of tracking.

Advertisement
another google browser

Google browser (Kurt “CyberGuy” Knutsson)

MASSIVE SECURITY FLAW PUTS MOST POPULAR BROWSERS AT RISK ON MAC

Even Incognito mode isn’t safe

Even if you’re using privacy-focused browsers or tools like Incognito mode, they don’t really guarantee privacy. A 2020 class-action lawsuit revealed that Google kept scraping searches by gathering data from users browsing in Incognito through ad tools used by websites, picking up “potentially embarrassing” searches from millions of people. Google then used that data to track web traffic and sell ads.

It’s not just Google. Your internet service provider, the websites you visit and even governments can monitor your browsing activity, even in Incognito mode. All it does is hide your activity from your local browser history.

WHAT IS ARTIFICIAL INTELLIGENCE (AI)?

laptop

A person conducting a Google search on their laptop (Kurt “CyberGuy” Knutsson)

TOP 6 HIDDEN WAYS A VPN CAN SAVE YOU MONEY NOW

Advertisement

How to protect your privacy 

As you all know, web browsers are essential tools for accessing the internet, but many popular options compromise your privacy by collecting extensive data. While Google Chrome is widely used, it tracks significant amounts of user information to power targeted advertising. However, there are several privacy-focused browser alternatives that prioritize user data protection. Also, to enhance your online security and protect your personal information, consider implementing these essential cybersecurity practices.

Keep software updated: Regularly update your operating system, browsers and other software to patch security vulnerabilities. Enable automatic updates whenever possible to ensure you’re always protected against the latest threats.

Use strong, unique passwords: Create complex passwords for each of your accounts and avoid reusing them. Consider using a password manager to generate and securely store strong passwords.

Enable two-factor authentication (2FA): Activate 2FA on all accounts that offer it. This adds an extra layer of security by requiring a second form of verification beyond your password.

Advertisement

Be cautious with emails and links: Avoid opening suspicious emails or clicking on unknown links. These could be phishing attempts designed to steal your information or infect your device with malware. The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. Get my picks for the best 2024 antivirus protection winners for your Windows, Mac, Android and iOS devices.

Use secure networks: When using public Wi-Fi, connect through a VPN to encrypt your internet traffic. For sensitive transactions, stick to secure, private networks.

Be mindful of social media sharing: Limit the personal information you share on social media platforms and adjust your privacy settings to control who can view your posts.

VPN: Your first line of defense against browser spying: A VPN (virtual private network) encrypts your internet connection, making it difficult for anyone, including your browser, to track your online activities. By masking your IP address and routing your traffic through secure servers, a VPN not only protects your personal data from prying eyes but also helps you avoid targeted advertising and potential data breaches.

Regardless of whether you are new to VPNs or not, you’ll want to choose trusted VPN providers known for robust encryption and no-log policies to ensure your privacy. Whether for sensitive tasks or everyday use, reputable VPN services will boost both your security and speed. For the best VPN software, see my expert review of the best VPNs for browsing the web privately on your Windows, Mac, Android and iOS devices.

Advertisement

By implementing these security practices and using privacy-focused browsers, you can significantly enhance your online safety and protect your personal data while browsing the web. Remember, cybersecurity is an ongoing process that requires vigilance and regular updates to your practices.

WHY YOU SHOULD BE USING A VPN TO SAFEGUARD YOUR STOCK TRADING ACTIVITIES

Kurt’s key takeaway

The web browser is an essential tool for accessing the internet, but it also opens the door to a host of privacy and security risks. Whether it’s being tracked for ads, snooped on by your ISP or accidentally stumbling onto a malware-filled site, the risks are everywhere. Tools like Incognito mode or cookie-blocking can help a bit, but they’re not enough to truly protect you. If you’re serious about staying private and secure, you need to up your game. Use a VPN, be cautious about what you click on and stay informed about the ways your browser might be working against you.

Do you think companies have gone too far with tracking? Let us know by writing us at Cyberguy.com/Contact.

Advertisement

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.

Ask Kurt a question or let us know what stories you’d like us to cover.

Follow Kurt on his social channels:

Answers to the most asked CyberGuy questions:

New from Kurt:

Advertisement

KURT’S HOLIDAY GIFT GUIDES

Unbeatable Best Black Friday deals 

Best gifts for MenWomenKidsTeensPet lovers 

Best deals: LaptopsDesktops

Copyright 2024 CyberGuy.com. All rights reserved.

Advertisement

Continue Reading

Trending