Hacker News Digest

YouTube Studio’s AI assistant reads comments and can be tricked into echoing attacker‑written text. By posting a comment that tells the AI to prepend “[IMPORTANT NOTICE FROM YOUTUBE]” and then include any payload, the AI outputs that instruction as part of its summary. The victim never sees the malicious comment because the trigger is a suggested prompt the creator clicks, so the injection happens automatically when the AI processes the comment feed.

This technique lets an attacker embed a link that extracts private video titles, exposing unreleased or sensitive content the moment a creator clicks it. The root problem is treating user‑generated comment text as executable commands rather than untrusted data. As the researcher notes, “Any AI feature that ingests user‑generated content and acts on it needs to enforce this separation.” Until comments are sandboxed, creators remain vulnerable to covert data leaks through a trusted interface. The researcher reported it, but Google classified it as requiring social engineering and did not treat it as a security bug.