The Nationwide Data Expertise Improvement Company (NITDA) has issued an pressing cybersecurity advisory warning Nigerians about new vulnerabilities in ChatGPT that would expose customers to data-leakage assaults.
The company launched the discover by means of its Laptop Emergency Readiness and Response Staff (CERRT.NG).
The warning follows rising considerations about AI-powered instruments interacting with unsafe internet content material and the rising dependence on ChatGPT for enterprise, analysis, and public-sector duties.
What they’re saying
Based on the advisory, researchers found seven vulnerabilities affecting GPT-4o and GPT-5 fashions that permit attackers to govern ChatGPT by means of oblique immediate injection.
The company defined that hidden directions positioned inside webpages, feedback, or URLs can set off unintended instructions throughout common searching, summarisation, or search actions.
“By embedding hidden directions in webpages, feedback, or crafted URLs, attackers could cause ChatGPT to execute unintended instructions merely by means of regular searching, summarization, or search actions,” they said
- It added that some flaws permit the bypassing of security controls by masking malicious content material behind trusted domains. Different weaknesses benefit from markdown rendering bugs, enabling hidden directions to move undetected.
- In extreme circumstances, attackers can poison ChatGPT’s reminiscence, forcing the system to retain malicious directions that affect future conversations
They said that whereas OpenAI has fastened components of the difficulty, LLMs nonetheless wrestle to reliably separate real person intent from malicious information.
Potential impression on customers
NITDA warned that these vulnerabilities may result in a variety of cybersecurity threats, together with:
- Unauthorized actions carried out by the mannequin
- Unintended publicity of person data
- Manipulated or deceptive outputs
- Lengthy-term behavioural adjustments brought on by reminiscence poisoning
- CERRT.NG added that customers might unknowingly set off these assaults with out clicking or interacting with something, particularly when ChatGPT processes search outcomes or webpages containing hidden malicious directions.
Preventive measures
The company suggested Nigerians, companies, and authorities establishments to undertake a number of precautionary steps to remain secure. These embody limiting or disabling the searching and summarisation of untrusted web sites inside enterprise environments and enabling options like searching or reminiscence solely when vital.
It additionally really helpful common updates to deployed GPT-4o and GPT-5 fashions to make sure recognized vulnerabilities are patched.
What it is best to know
Just a few months in the past, the company issued a public alert warning Nigerians a couple of essential safety flaw affecting embedded SIM (eSIM) playing cards utilized in smartphones, tablets, wearables and IoT units.
The vulnerability was traced to the GSMA TS 48 Generic Take a look at Profile (model 6.0 and earlier), a testing commonplace utilized to eUICC chips. On the time, NITDA disclosed that greater than 2 billion units worldwide have been uncovered to dangers that would permit attackers to put in malicious applets, extract cryptographic keys and even clone eSIM profiles.
The company warned that profitable exploitation may end in intercepted communications, persistent system management and stealth backdoors on the SIM card degree.
