Leaking YouTube creators' private videos

Original Article ↗ Hacker News Discussion ↗

A YouTube feature that uses an AI model to summarize creator comments can be tricked via prompt injection into generating attacker-controlled links containing the titles of private or unreleased videos. Commenters debate whether this constitutes a genuine security vulnerability or merely social engineering, especially since it requires the creator to click the generated link, and note that Google’s bug bounty program declined to treat it as a reportable issue. The incident broadens into concerns about LLMs ingesting untrusted user content, the practical impossibility of fully “fixing” prompt injection, and misaligned incentives at large tech companies that favor shipping AI features over hardening them.

Vulnerability and attack mechanics

  • Attack uses YouTube Studio’s AI comment summarizer: a malicious comment embeds instructions that cause the LLM to prepend an official‑looking notice and output an attacker‑controlled link.
  • The link’s query parameter is filled with channel metadata the LLM can see (e.g., a video title, potentially from private/unlisted videos). When clicked, this leaks that data to the attacker’s server.
  • Some users tested and could not reproduce; others report it appears quietly fixed (e.g., no links, or AI warns about phishing‑like comments).

Debate over severity and classification

  • One camp: this is a real vulnerability because:
    • Untrusted user input (comments) can influence trusted UI output (Studio AI).
    • Links appear to originate from YouTube, lowering suspicion.
    • LLM non‑determinism plus YouTube’s scale means even low‑probability success is dangerous.
  • Other camp: impact is limited:
    • Requires the creator to click a suspicious link; akin to classic phishing.
    • Only leaks titles or unlisted URLs, not video content; private videos remain access‑controlled.
    • Example PoC as written may assume knowledge it claims to exfiltrate.

Prompt injection, LLM limits, and mitigations

  • Many argue prompt injection is fundamentally unfixable: LLMs don’t truly separate “data” from “instructions.”
  • Suggested mitigations:
    • Strip or neutralize links/HTML/Markdown in LLM input and output.
    • Don’t give summarization agents access to private channel data or tools.
    • Use separate LLM instances or “patterns” to isolate untrusted content.
    • Add framing/warnings that AI responses may include user‑generated content.
  • Others are skeptical that role boundaries or monitor‑LLMs can reliably stop attacks; see it as an arms race.

Google/YouTube incentives and bug bounty handling

  • Some former and current Googlers describe internal incentives (promo/GRAD) that favor new features over fixing subtle bugs.
  • Others counter that VRP severity is set by specialized security teams and that Google generally has good security culture but is overwhelmed by low‑quality, often AI‑generated reports.
  • Several commenters note a pattern: reports labeled “not a bug” then quietly patched, undermining researchers’ trust and bug‑bounty incentives.

Trust, social engineering, and broader risks

  • Even if technically “just” social engineering, the platform is:
    • Laundering attacker instructions through YouTube’s authority (“IMPORTANT NOTICE FROM YOUTUBE”).
    • Creating new phishing surfaces (fake billing, account actions, misdirected voting info, etc.).
  • Commenters stress that average creators are unlikely to distinguish AI‑generated warnings from real platform messages, making this a serious creator‑trust and safety issue.