“I was really surprised to see this work: I had assumed OpenAI would block Markdown images like this from loading content from external servers. Johann disclosed the Markdown exfiltration vulnerability to them in April”
One image with text in a speech bubble told GPT-4V to summarize the private chat and stuff it into a Markdown image URL. The model did it, and Johann Rehberger’s server logged the conversation. OpenAI had known about the Markdown leak since April and shipped vision anyway. Every image a user uploads is now a set of instructions from a stranger.