Let ChatGPT visit a website and have your email stolen
So I think what's happing here:<p>1. The WebPilot plug-in is used for accessing the webpage that the user is asking to summarise<p>2. The prompt injection on that webpage then triggers the Zappier plugin to access the users email. This depends on the user having that plugin setup and enabled with access to their email.<p>3. The WebPilot plugin is then used again to exfiltrate the data.<p>It would be nice if the prompt on that page was shown, but I understand why they have removed it.<p>Essentially what OpenAI need to add is a positive assertion from the user each time a plugin is triggered indicating the actions that are going to take place. It's somewhat mad that that has not been implemented, "move fast and break things".