While prompt injection remains unsolved, for this particular issue there is a known mitigation: don't ever support markdown (or HTML) images that load images from domains you do not control! More painful but also necessary: don't support outbound clickable links either
SECURITY
-
RAG Security: Prompt Injection Risks in Untrusted Data Processing
By
–
Yet another example illustrating an inconvenient truth: If you build a RAG system that can be used to process data from untrusted sources, and you include the ability to embed images from or links to external domains, then you're going to have prompt injection exfiltration holes
-
OpenAI’s vague data usage policies raise transparency concerns
By
–
OpenAI have been infuriatingly vague about what "using ChatGPT conversations to help improve our models" actually means They have various opt-out options even for free usage these days but it's hard to keep track of where they are and how they work
-
Dan Discusses Consent Mode in AI Privacy Video
By
–
Dan talks about consent mode in this video at 4m27s https://t.co/BwqCcA8HDX
— Simon Willison (@simonw) 15 avril 2024Dan talks about consent mode in this video at 4m27s
-
Limitless Pendant LED Recording Consent Mode Privacy Features
By
–
This bit is interesting: > An LED lights up whenever it’s recording, and the Limitless Pendant also has a “Consent Mode” that detects new voices and doesn’t record them until the software hears them agree to being recorded. (It’s worth noting this mode is off by default.)
-
AI Security Risk: Prompt Injection in Context-Aware Systems
By
–
"I have access to your email, I have access to your Slack messages — when you get a message for which the context of your past can help answer it, I can just give you that draft." Hope they're thinking hard about prompt injection!
-
Privacy implications of always-on home microphones versus wearable recording devices
By
–
I think Alexa at home is different – there you are opting into having a microphone in your own personal space – not the same thing as openly wearing a microphone out in the world visibly in front of strangers
-
Google Glass Backlash: Surveillance Concerns and Tech Industry Reactions
By
–
Google Glass wearers were being attacked in San Francisco ten years ago – though that could partly have been a reaction against the tech industry generally, hard to know if it was directly due to surveillance concerns
-
Social Acceptance Challenges for Recording Devices Privacy Concerns
By
–
I don't see how these products can get over the social factor that nobody likes the idea that someone else is recording them without their explicit permission Whether or not the devices actually do that doesn't matter – just wearing an inactive microphone or camera is risky
-
Hacking AI Pin to Run Gemma 2B Locally Without Internet
By
–
Who is going to be the first to find a way to hack the ai pin and run like Gemma 2B locally on it and see how it works instead of needing an internet connection (or only periodically phoning a cv/tts model)?