The behavior of ChatGPT’s web crawler can be exploited through a discovered vulnerability: under specific query conditions, OpenAI’s bot may inadvertently execute DDoS attacks on arbitrary websites. This intriguing flaw was reported by cybersecurity researcher Benjamin Flesch. According to him, a single HTTP request to the ChatGPT API could trigger a flood of unrelenting network requests targeting a specific web resource.
While the scale of such DDoS attacks might be insufficient to disable well-protected websites, the researcher still regards this as a significant oversight by OpenAI. For instance, the ChatGPT crawler could potentially generate between 20 and 5,000—or even more—requests per second to the same website for each API query.
“ChatGPT API exhibits a severe quality defect when handling HTTP POST requests to https://chatgpt.com/backend-api/attributions. The API expects a list of hyperlinks in parameter urls. It is commonly known that hyperlinks to the same website can be written in many different ways. Due to bad programming practices, OpenAI does not check if a hyperlink to the same resource appears multiple times in the list. OpenAI also does not enforce a limit on the maximum number of hyperlinks stored in the urls parameter, thereby enabling the transmission of many thousands of hyperlinks within a single HTTP request,” Flesch explains.
Unfortunately, the web crawler does not check for duplicate links leading to the same domain, nor does it impose a limit on the maximum number of hyperlinks in the URL parameter. When this vulnerability is exploited, the affected website owner would observe traffic from ChatGPT’s crawler. Even if these addresses are blocked via a firewall, the crawler continues to dispatch requests relentlessly.
As of Friday, January 10, 2025, despite numerous reports through official legal channels, this software defect remains unaddressed by OpenAI or Microsoft, and neither entity has acknowledged its existence.
Related Posts:
- OpenAI Considers Ads for ChatGPT: Will Free Users Pay the Price?
- AI’s Dark Side: Hackers Harnessing ChatGPT and LLMs for Malicious Attacks
- The Dark Side of ChatGPT: Trade Secret Leaks in Samsung
- Facebook emphasized the surge in malware masquerading as ChatGPT
- Hackers Fake ChatGPT App to Spread Windows, and Android Malware
