Specialists from the CyberSecurity Research Center (Cyrc) Synopsys have found Zero-Day vulnerability in emailgpt, popular expansion for Google Chrome, using artificial intelligence for writing emails.
Vulnerability of the type “Prompt Injection” with the identifier cve-2024-5184 allows attackers to manipulate the service and gain access to confidential information.
Emailgpt uses publicly available AI models from Openai to help users in compiling letters in the Gmail service. Users receive II subscriptions to write letters, providing the service source data and context. However, the recent discovery revealed a serious flaw in the work of expansion.
Emailgpt uses an API service that allows attackers to introduce third-party industrials and manage the logic of the service. This can lead to a leak of system tips or the execution of unwanted commands.
So, an attacker can create a Prompt that embeds unwanted functionality, which can lead to:
- data extraction;
- spam-campaigns using hacked accounts;
- Creation of misleading content for mailing;
This vulnerability, estimated at 6.5 points on the CVSS scale, can also lead to intellectual property leak, refusal to maintain and financial losses.
Synopsys reports that their researchers contacted EmailgPT developers before the publication of parts, but did not receive an answer. Synopsys recommends immediately remove emailgpt from its browser, because there is no vulnerability to soften the consequences of vulnerability yet.
Users are recommended to monitor updates and patches to ensure security. As II technology develops, the importance of vigilance and reliable security measures increases.
Patrick Harr, the CEO of Slashnext Email Security, noted the importance of strict management and the introduction of additional security measures for II Models to prevent the emergence of vulnerabilities and their subsequent operation.
Harr also added that companies planning the integration of AI into their business processes must demand real evidence of their security from the suppliers of AI-Models.