用户自定义GPT可以被prompt injection攻击，导致提取自定义system prompt（system prompt extraction），获取已上传的文件（file leakage）等问题。测试了OpenAI store中超过200个custom GPT models。

Background

code interpreter

“the code interpreter could enable the GPT to not only understand data-related queries but also to execute data analysis scripts provided in the prompts.”

Approach

(1) scanning custom GPTs, (2) injecting adversarial prompts, and (3) extracting target information.

Evaluation

• disabling the code interpreter in custom GPTs significantly enhances security against prompt injection.
• solely relying on defensive prompts for security is inadequate.