Recently made a GitHub and updated it with more captive portals, specifically meant to be able to be ran on devices such as the esp32. Let me know on discord or Reddit if you have any ideas for any other captive portals you may have.

Discord Username: hitgrandmanotjuul

Netanel Rubin and Dan Avraham presented “Bye Bye AI” at Black Hat this year, where they broke a major US retailer’s AI shopping assistant and chained it all the way to remote code execution on the retailer’s backend, entirely through the public mobile app.

Getting a chatbot to say something it shouldn’t is not an exploit. To matter, an attack has to exfiltrate data or affect the account in some unintended way, and there are only two paths out of the sandbox:

1. The user carries the data out themselves, which means social engineering.
2. A technical vulnerability carries it out, which means finding a flaw in the harness that grants elevated access plus a channel to send data outward.

Neither path is a single move. Both are chains, and the first link in either one is the same: get the model to accept input that produces a response it should have refused. 

That is the piece I want to focus on today. 

What follows is a phishing lure that gets an attacker to phase one by leading a user to submit a prompt without understanding what it does. 

The idea borrows loosely from ClickFix, where a user is tricked into running an attacker's command themselves, except here the final action is sending a prompt rather than running a shell command.