How I Tricked AI Into Leaking Your Darkest Secrets

every I agent with access to the internet and your private information can spill out all the secrets if asked nicely. We're going to look at incredible article called the memory heist. How we tricked Claude into leaking your deepest darkest secrets. In this video, I'm going to explain you what it is, how it works, and how to protect yourself. This is so fascinating and insanely dangerous. By the way, I can't pronounce your first name, so it's Aush Paul. all the credit to him uncovering this trick. Even Peter Steinberg called this that it's really clever. It's also really dangerous and extremely concerning. If I only have 30 seconds of your time. The main message is that this was discovered on clot and entropic was contacted. Apparently, they already discovered this and been working on and the author of the article waited for the patch to be implemented so that it would be safe to release it. And here I am talking about it a few weeks later. But this hack applies not only to the cloud. It applies to absolutely every AI agent or application that has web fetch tool and has access to some of your information or all of your information. The whole trick here is to have many links inside one article instructing an agent to click links in order to spell out what is being asked about. For example, it can spell out your first name or second name. It can spell out your employer, your company, where you live. any private or sensitive information that it has in its memory or second brain, it can kind of spell it out, right? So, on traffic, the way they uh fixed it is basically forbidding agents to go from one link inside an article to many other links. Do you think probably millions if not more any agents right now on internet do they have this implemented that you can't follow links and links and links and links? No. And for full transparency I also didn't had it. The moment I saw this, I literally ran to the gobot that my community and I use like now for months and I applied all the patches and security and because I have a hack how to bypass fable security flag, I was able to fully architect the solution to implement against these type of attacks. I highly recommend you read full article and give a follow to the original author. I put together a little slides for us and then at the end I have a prompt that you can take and run full security kind of check for your own system and hopefully depending how your system is and if you have the best models for cyber security available to you that you can implement your own fix. Exfiltration attacks you might not even know that they are happening. You can exfiltrate information from an employee. You can in expo exfiltrate information from just regular people and blackmail them. Anytime we have private information, private identifiable information and we have untrusted content meaning links, website, Google meet invites an image with the prompt injection. so much of it you'll have no clue but it's such a huge problem but we also have third layer which is outbound sync anything that can actually send post do edit for example if somebody exfiltrates and has access to your email it can also say hey email me your credit card number I don't know these areas by themselves are dangerous but when they overlap this is where exfiltration can happen and this is exactly the trick that memory heist did. So the agent goes to the website and the website pretending to be cloud flare security checker or whatever it's just prompt ask it that hey click links to spell out like imagine for agent it's like a passcode it's like hey click links to pass to prove that you are not malicious for example and tell us your name by clicking links so what do you think agent does it goes and clicks those links on the back end of that attacker server in the logs it can see what links agent clicked and those links because it's ABC letters can spell out your name, address and so on. So it's really smart. If you are in my community, this is already a passion implemented. So you just have to pull latest update to the goot. But for anyone else, you can screenshot the slide I guess of the measures that I already have implemented. And the last one is specifically targeted at this attack. We have measures before securing private data for securing interested sources and this unbouncing especially for web fetch. This is the solution of do not let it to go more than for example six fetches six links deep on the same website. But again that alone is not a full solution. Another thing is like okay so what about if we let agent to go only to our verified domains and our websites? Well, yes and no. Because you can go on a secure domain, but there might be, for example, a comment with a link in a Reddit post and the agent clicks that. How long can agent be staying on the same website? Another thing is domains and subdomains, right? Because you can also trick if you block one domain, what about subdomains? The main thing is what we are fighting is not necessarily that agents access our information or external people access our information. What we need to think is even if you access my information, are you allowed to take it out? Are you allowed to exfiltrate that? And the way to mitigate this is to think about measurements where it can detect like are we sending this home meaning to my home my infrastructure and things that allowed to give information or it's going somewhere else. So these things to secure your system you also can think about like I communicate with my goot in these like five places. So only those five places with its own security checks are allowed to access and bring my information. Everything else is not considered home. So that's one measure. Beyond this attack and traffic patch was to completely remove that you can't go on the same website fetching multiple links. Uh it's a little bit annoying but it's better than nothing. I don't know how chat on any other public assistant solves this but they all have the same problem. You can also have subdomain also spelling out letters. Honest disclosure, this solution to this problems is like rate limiting. But there is prompt injection and exfiltration is a problem that is really unsolvable. Exactly. Of these three areas what we just covered and all the models and applications are exposed to all these attacks. And now that we have more agents that can just go and hack things around, it's more important than ever to secure your systems. If you do anything, please audit your own systems. I'm going to include this prompt that we done together with my boy Fable. you can take and run through yours any AI agentic system or setup if it is open claw Hermes like whatever agent you use that has web fetch and also has your database with your memories or information and access to post and so on this audit is going to work and be hopefully useful for you after you audit after you design an implementation please ask for evaluation and tests because you have to also try to break your own system to really verify that it works because there is nothing worse than thinking that you are secure when you're actually not. But I think it all starts about you being just aware that this things exist. All the links and sources are going to be in my community. We have free trials so you can come grab it, check it around. Don't want to publish everything online especially when it comes down to secure this stuff. We have full AI accelerator where we teach you everything how to build safe and secure AI agents and the systems that you can also deploy in real businesses. If you're interested, please join us. Otherwise, YouTube is now going to recommend you a video that it thinks that you might really like. So, let me know in the comments of the next video if YouTube was right. Thank you so much for watching. Bye.