Yeah, and as noted over there, this isn't so much an attack. It requires:
- you give a system access to your private data
- you give an external user access to that system
It is hopefully obvious that once you've given an LLM-based system access to some private data and give an external user the ability to input arbitrary text into that system, you've indirectly given the external user access to the private data. This is trivial to solve with standard security best practices.
- you give a system access to your private data - you give an external user access to that system
It is hopefully obvious that once you've given an LLM-based system access to some private data and give an external user the ability to input arbitrary text into that system, you've indirectly given the external user access to the private data. This is trivial to solve with standard security best practices.