> But the problem isn't if they use a classifier or not
I am sure that OpenAI would say that this is very important to support as a feature, but I kind of disagree with this. I think it is a problem for them to use a classifier, because this problem is possible to solve without an opaque classifier, it's solveable with CORS.
OpenAI could just not load remote images. There just are better ways to do this. I can't believe I'm going to bat for ChatGPT Addons, which also appear to be security disasters, but the addons do exist, and so for scenarios where remote images really do need to be fetched, extensions could provide that with more safety. Having approved widgets/plugins in the chat for stuff like previews would not completely solve the problem, like you mention vulnerabilities and attacks would remain. But it would help a lot.
To your point of communication, it's wild to me that OpenAI would start with a classifier instead of starting with a button on top of every image that says "click to load" and shows the URL. That communicates way more information to the user, it's simpler to build, it's more consistent and avoids the problem of images that are safe randomly refusing to load.
And I keep going back to... I know OpenAI would say there are a lot of use-cases for being able to fetch random images. It's not that use-cases don't exist at all. But I just don't buy it, I don't see how the benefits outweigh the downsides. I feel like most other platforms have figured this out: if an attacker can read data from a site and craft custom payloads, you set strict CORS and you don't allow them to send that data anywhere. OpenAI is treating this like a unique situation and doing something weird because they don't like the obvious solutions.
LLM security is a nightmare that might not be possible to solve, and you're absolutely correct that for many of those security risks, imperfect safeguards and user consent/communication is likely the best we're going to get. But in this one very specific area, we have lots of solutions for data exfiltration that at the very least significantly reduce the attack surface.
> Of course they are.
I don't know, I don't take this as a given, it wouldn't surprise me if they're doing something at least slightly better like looking at caches. But I guess it also wouldn't surprise me a huge amount if they're doing something nonsensical like asking GPT "is this URL safe", which is just not a good approach to take.
I'm not accusing them of that, I assume (hope) that they're not doing that. It just wouldn't necessarily surprise me.
> I'm concerned that it's not AI that'll get us paperclipped, but we'll just do it ourselves.
This is a very separate conversation and normally I wouldn't touch on it, but... opinion me, yeah, agreed. I am not worried about existential risks from AI, I'm worried about companies ruining everything because they're not willing to engage responsibly with any this or to even just think critically about where the real use-cases are vs where they're using a screwdriver to hammer in a nail.