Malicious custom GPT 'Psychology' exfiltrates user chats via API
Date: 2024-01
Affected: OpenAI GPT Store users
Attack vector: data-exfiltration
Category: real-world
Severity: High

Researchers created a custom GPT named 'Psychology' that appeared to assist users with psychological issues but silently sent each user message to an attacker-controlled server via an API action, demonstrating data-exfiltration risk in the GPT Store.


Mitigations:

Architectural layers (MAESTRO):