TLDR Tech / InfoSec
OpenAI Patches ChatGPT Data Exfiltration Flaw and Codex GitHub Token Vulnerability
Check Point found a flaw in ChatGPT that let a malicious prompt silently exfiltrate user messages and uploaded files via a hidden DNS channel in the Linux runtime, with Custom GPTs being able to bake it in, no user interaction required. Separately, BeyondTrust found a command injection bug in OpenAI Codex: injecting commands via a crafted GitHub branch name could steal GitHub tokens and grant read/write access to the victim's full codebase. Both have now been fixed.
Read the full story