Comment by nojs

Yeah it seems to be: create a custom GPT that is instructed to silently share the user’s responses with a third party server. I guess the mitigation is to assume conversations you’re having with anything whose prompts you can’t see is not private.