ChatGPT is labeled as a “research preview,” meaning it is not an official product. This means that if you use it, you may not be covered by product liability. Plus, the ChatGPT plugin is a beta feature within Research Preview, so take what you like from there.
ChatGPT’s Plugin Review Policy
ChatGPT reviews plugins before they are available in the store, but OpenAI has only a very small number of plugins available for review at this time. To be accepted in the store, plugins must comply with OpenAI’s Content and Plugin Policy. This means:
- This plugin cannot be used to spread malware, fraud, or misinformation
- Plugins cannot circumvent or interfere with OpenAI’s safety systems
- The plugin manifest must have a clear description that matches the functionality of the API exposed to the model
OpenAI said the plugin review process is still in its early stages and will “change significantly over time.” If you use the ChatGPT plugin extension, you must perform at least the following steps before activating it:
- Vet the legitimacy of the developer and plugin (start by checking the website).
- Read the description and look for anything suspicious
- See if you can find reviews by other users
Don’t install anything you don’t need
When it comes to plugins, install only the ones you need. ChatGPT makes this easy, as this minimizes the attack surface and limits you to three plugins. However, this also applies to not installing many plugins and avoiding switching between them. In the words of Marie Kondo, if it doesn’t bring you joy, uninstall it.
If you’re tech-savvy, you can use the ChatGPT plugin to see what’s going on under the hood (sort of). However, most people cannot distinguish between normal code and malicious code.
ChatGPT is not immune to direct hacking (it has been hacked before)
Malicious attackers can and do turn their attention to attacking ChatGPT directly. OpenAI recently confirmed a data breach in its systems caused by a vulnerability in the Redis client open source library (Redis-py) it was using.
During that time, other users may have seen the first message of the newly created conversation, OpenAI said. It is also possible that payment-related information, first and last names, email addresses, payment addresses, and some credit card details of his ChatGPT Plus subscribers who were active in a particular 9-hour window were unintentionally exposed. There is a gender.”
In other words, ChatGPT is Also Because it is a third-party tool, it is an attack vector for malicious parties to exploit.
