The vulnerability Google won't call a bug

Sun, 05 Jul 2026 00:00:00 +0000

A researcher found a way to steal the titles of your private YouTube videos using nothing but a comment. Google looked at the report and decided it wasn’t a security bug.

He was testing Ask Studio, the AI assistant YouTube added to its creator dashboard so channel owners can ask things like “what are people saying about my last upload.” The flaw shows up in what happens when a comment isn’t feedback but an instruction. Edit a comment after posting it, since YouTube doesn’t re-notify the creator of edits, word it as a directive instead of an opinion, then wait for the creator to click one of YouTube’s own suggested prompts, which pulls every comment into the model’s context automatically. Ask Studio can’t tell a fan complaining about pacing from a hidden command telling it to reformat its answer around attacker-controlled links. Push that far enough and Ask Studio, which has authenticated access to private and unlisted video data, can be made to leak titles of videos nobody is supposed to see yet.

Prompt-Injection on Dr. Hitesh Sarda

The vulnerability Google won't call a bug