Mmastodon TechnologyCybersecurity first seen 2 d ago, last 2 d ago, peak #8

AI log readers tricked into leaking secrets in 30+ bypasses

Original: An AI that reads your logs can be told by your logs to leak your secrets. I let three models attack our link filter: 30+

A security researcher reports that AI systems which read application logs can be manipulated by content inside those logs to leak secrets. In testing three AI models against a link filter, the researcher documented more than 30 bypasses, most involving parser differentials between Python and JavaScript, such as whitespace handling, %5c encoding before @ symbols, and HTML comments. A full write-up has been published.

Why now: Prompt injection through logs is an emerging AI security risk, and the concrete bypass techniques are useful to defenders.

jl3-cloud.sitePythonJavaScript

Open on mastodon →

Evidence

• An AI that reads your logs can be told by your logs to leak your secrets. I let three models attack our link filter: 30+ bypasses, most of them parser differentials (Python vs JavaScript whitespace, %5c before @, HTML comments). Write-up: https:// jl3-cloud.site/blog/30-ways-to… · justdev3 · 1

API: https://socialmediatrends-api.osmike.com/v1/trends/2700037