Functionalities

• Instructions.
• Knowledge. upload files (e.g., text files, images, programs)
• Capibilities. Web Browsing, DALL E Image Generation, Code Interpreter
• Actions.
  • developers can enter a schema describing how requests to outside websites or applications should be handled through GET/POST.
  • can also interact with external web applications on behalf of the user through authentication (API key and OAuth), such as adding an event in the user’s Google calendar.
  • developers are required to provide a privacy policy for using actions.

Channels of Entry/Exit

users ↔️ custom GPTs

• Conversation.
• File.
  • upload: by user in the conversation / by developer in knowledge
  • modify (code interpreter): by GPTs
  • execute (code interpreter): program files
  • download (code interpreter): by user in the conversation (including text files, images, programs)
• Network. web browsing
  • Bing. determined automatically by GPTs.
  • accessing specific websites. determined by schema in Actions.
• Operational commands. code interpreter
  • upload: conversation, instructions, files (by user / developer)
  • execute: Python programs executed on the virtual operating system.
  • other languages: automatically translate into Python.
• Authentication.
  • read or modify contents in users’ external applications

Threat Models

• the custom GPT (i.e. the GPT developer) & the end user

T1: Malicious GPTs & Benign User

• conversation, file, network, command, authentication
• benign user: provide private & sensitive data
• malicious GPT
  • integrity violation: modify data
  • privacy leakage: secretly sends the user private data to an external source

T2: Benign GPT & Malicious User

• conversation, file, network, command, authentication