How to jailbreak ChatGPT and trick the AI into writing exploit code using hex encoding

OpenAI's language model GPT-4o can be tricked into writing exploit code by encoding the malicious instructions in hexadecimal, which allows an attacker to jump the model's built-in security guardrails and abuse the AI for evil purposes, according to 0Din researcher Marco Figueroa.

0Din is Mozilla's generative AI bug bounty platform, and Figueroa is its technical product manager. Guardrail jailbreak - finding ways to bypass the safety mechanisms built into models to create harmful or restricted content - is one of the types of vulnerabilities that 0Din wants ethical hackers and developers to find in GenAI products and services.

In a recent blog, Figueroa details how one such guardrail jailbreak exposed a major loophole in the OpenAI's LLM and allowed him to bypass the model's safety features and trick it into generating functional Python exploit code that could be used to attack CVE-2024-41110.

That CVE is a critical vulnerability in Docker Engine that could allow an attacker to bypass authorization plugins and lead to unauthorized actions, including privilege escalation. The years-old bug, which received a 9.9 out of 10 CVSS severity rating, was patched in July 2024.

At least one proof-of-concept already exists, and according to Figueroa, the new GPT-4o-generated exploit "is almost identical" to a POC exploit developed by researcher Sean Kilfoy five months ago.

The one that Figueroa tricked the AI into writing, however, relies on hex encoding, which converts plain-text data into hexadecimal notation, thus hiding dangerous instructions in encoded form. As Figueroa noted:

This attack also abuses the way ChatGPT processes each encoded instruction in isolation, which "allows attackers to exploit the model's efficiency at following instructions without deeper analysis of the overall outcome," Figueroa said, adding that this illustrates the need for more context-aware safeguards.

Plus, the write-up includes step-by-step instructions and the prompts he used to bypass the model's safeguards and write a successful Python exploit, so that's a fun read. It sounds like Figueroa had a fair bit of fun with this exploit, too:

Figueroa opined that the guardrail bypass shows the need for "more sophisticated security" across AI models, especially when instructions are encoded, or otherwise cleverly obfuscated.

He suggests better detection for encoded content, such as hex or base64, and developing models that are capable of analyzing the broader context of multi-step tasks, rather than just looking at each step in isolation.

Figueroa feels better AI safety requires more advanced threat detection models that can identify patterns consistent with exploit generation, even when those are embedded within encoded prompts. ®