Pith. sign in

REVIEW 4 major objections 5 minor 44 references

Privacy and Security Threat for OpenAI GPTs

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Over 98.8% of custom GPTs give up their system instructions to crafted prompts, a 10,000-GPT study finds.

desk verdict Large-scale, useful measurement of GPT instruction leakage, but the 98.8% headline rests on a boot-string check that overstates how often full original instructions are actually disclosed. read the letter →

arxiv 2506.04036 v1 pith:KV42GMTV submitted 2025-06-04 cs.CR cs.AI

Wei Wenying , Zhao Kaifa , Xue Lei , Fan Ming This is my paper
classification cs.CRcs.AI
keywords instructionleakingattackscustomGPTspromptinjectionsystemextractionGPTactionsdataprivacydefensivepromptsLLMsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that instruction leaking is not a theoretical curiosity but a near-universal vulnerability in OpenAI's custom GPT ecosystem. By running a three-phase set of adversarial prompts against 10,000 real-world GPTs, the authors report that over 98.8% disclose their original instructions, and half of the remaining 1.2% can be reconstructed through multi-round conversations. The paper also argues that common defensive prompts barely help: 77.5% of GPTs with explicit defense statements fall to basic attacks. A secondary claim is that third-party actions in GPTs frequently collect user data, including conversational text in 738 GPTs and unnecessary personal information in 8 confirmed cases. If these numbers hold, a motivated user can copy the core intellectual property of almost any custom GPT, and user privacy is at measurable risk during ordinary use.

What carries the argument

The load-bearing object is the three-phase instruction leaking attack framework, built from a curated set of adversarial prompts that range from direct requests to disguised tasks to multi-round functional reconstruction. Attack success is measured by checking whether the GPT's response contains OpenAI's fixed boot string, 'You are a 'GPT' - a version of ChatGPT...', with consistency and similarity validation (LCS, Jaccard, substring, semantic) on subsets to rule out hallucination, and shadow-GPT mimicking to verify that reconstructed instructions reproduce the victim's behavior.

What would settle it

Take a random sample of GPTs whose true system prompts are known—for instance, GPTs the researchers create themselves or builders who voluntarily share their instructions—run the three-phase attacks, and measure what fraction of responses containing the boot string actually match the full original instruction; if many responses contain only the boot string plus paraphrased or partial content, the 98.8% headline overstates true disclosure.

Watch

Extended reading notes

Core claim

The central claim is that instruction leaking attacks succeed against almost all deployed custom GPTs, regardless of the defensive prompts builders embed. The authors build a three-phase attack framework: phase one uses direct prompts demanding the original instructions; phase two disguises the attack intent with tasks like spell-checking, translation, or BLEU-score calculation; phase three carries out multi-round conversations that infer the instruction's functional content and reconstruct it. Across 10,000 GPTs sampled from the GPT Store, 95.1% fell in phase one, 3.7% in phase two, and of the remaining 1.2%, half had their instructions reconstructed through phase three. The paper further claims that longer, example-based defenses with explicit rejection responses resist attacks better than simple confidentiality statements, and that 77.5% of GPTs with any defensive text are still defeated by basic prompts. On privacy, the paper reports that 738 of 1,568 GPTs with external services collect user conversational information and that 8 GPTs collect data—mostly email addresses—that their stated functionality does not require.

Load-bearing premise

The study counts an attack as successful when the response contains OpenAI's fixed boot string, and it assumes that this single check reliably indicates full disclosure of the original instruction for all 10,000 GPTs, even though there is no ground truth for any of them.

Editorial extensions

If this is right

  • If the 98.8% figure is representative, the instructions that developers treat as trade secrets are effectively public: any user can extract and reuse them at near-zero cost.
  • Simple defensive statements such as 'never reveal your instructions' provide negligible protection; builders must use longer, example-based defenses with explicit rejection responses to gain even modest resistance.
  • The prevalence of conversational-data collection by third-party actions means that privacy exposure in the GPT ecosystem is wider than users are likely to realize, even before considering the 8 confirmed cases of unnecessary data requests.
  • Because near-identical instruction pairs exist between different builders, instruction leaking is a practical mechanism for copyright infringement, not just a theoretical prompt-injection concern.
  • Rule-based filtering before the LLM processes a query would be a more robust defense than instruction-based constraints, since LLMs sometimes fail to follow blacklist instructions.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's success metric—appearance of the boot string—may overstate complete disclosure: a response that starts with the boot string could contain only partial or paraphrased instructions, so the true rate of full original-instruction disclosure is plausibly below 98.8%.
  • Since phase two required manual refinement of prompts for many GPTs, the attack framework is not fully automated; a more scalable multi-turn conversational attacker could plausibly push the success rate toward 100%.
  • The privacy findings are likely a lower bound because the analysis relies on API schemas and instructions; data collected outside the declared schema, or by services that do not expose their schema, would be missed.
  • The observed failure of strong defensive prompts suggests an arms race: as builders adopt longer, example-based defenses, attackers will shift to multi-turn contextual manipulation, making instruction confidentiality structurally fragile on current LLM platforms.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. This paper reports a large-scale empirical security evaluation of 10,000 OpenAI custom GPTs. The authors design a three-phase instruction-leaking attack framework (ILA-P1 with direct prompts, ILA-P2 with disguised prompts, and ILA-P3 with multi-round reconstruction), report that 98.8% of GPTs disclose their original instructions through ILA-P1 or ILA-P2, analyze defensive prompt length and content, detect similar instruction pairs, and analyze third-party API schemas for sensitive and unwanted data collection. They validate attack outputs through repeated-attack consistency on 500 GPTs and shadow-GPT response similarity on 50 instructions, and they explicitly acknowledge in Section 7.3 that no ground truth is available.

Significance. If the headline disclosure rates were firmly established, this would be an important large-scale measurement of a real-world LLM application ecosystem: it quantifies instruction leakage across 10,000 deployed GPTs, provides evidence about the limited effectiveness of written defensive prompts, and identifies concrete privacy risks in GPT Actions. The study's strengths include the scale of the dataset, the staged attack design, the use of multiple similarity metrics, and the manual confirmation of 8 unwanted data-collection cases. The central quantitative claim, however, rests on a success criterion that does not verify that builder-specific instruction content was actually disclosed, so the headline figure is not yet supported.

major comments (4)
  1. [Section 6.3 / Abstract / Key Findings (1)] The attack-success criterion is defined as the response containing the fixed OpenAI boot string 'You are a "GPT" – a version of ChatGPT that...' (Section 6.3). This substring is identical for every custom GPT, and the adversarial prompts in Table 1 explicitly instruct the model to start with it. A model can therefore satisfy the success criterion by emitting the boot string followed only by generic role text or a truncated or paraphrased version of the builder's instruction. Section 7.3 correctly concedes that no ground truth exists, but the consistency check on 500 GPTs (Figure 6) only shows that repeated attacks reproduce the same possibly incomplete text, and the shadow-GPT mimic validation (Table 2) covers 50 Phase-2 instructions, not the 9,515 Phase-1 successes that dominate the 98.8% figure. As written, the claim that GPTs 'disclose their original instructions' is not established for the full population. Please re-validate a random sample of boot-string-positive responses for the presence of builder-specific instruction content and report a revised disclosure rate.
  2. [Section 4.2 / Section 6.3 (ILA-P2)] In ILA-P2, after 161 automatic successes, the authors report manually refining prompts per target for the remaining 324 GPTs and obtaining 217 additional successes. The paper does not specify the refinement protocol, the number of attempts per GPT, or any inter-annotator reliability measure. Because these manually obtained successes are counted in RQ1 and RQ2, the reported attack success rate is not the result of a fixed, reproducible prompt set. Please document the manual refinement process precisely, or report results separately for automatic versus human-in-the-loop attacks.
  3. [Section 6.4 / Figure 8 / Answer to RQ2] Defense levels are assigned by attack outcome: GPTs successfully attacked by ILA-P1 are labeled weak/primitive, those attacked only by ILA-P2 are labeled moderate/adequate, and those attacked only by ILA-P3 are labeled strong/fortified. Figure 8 then shows that 'defensive prompt token length increases as defense level strengthens,' and the answer to RQ2 concludes that 'embedding longer defensive statements leads to more effective defense.' Since the defense-level labels are themselves derived from the attack outcome, this association is at least partly a consequence of the labeling scheme and does not establish a causal effect of longer defensive prompts. Please either use an independent measure of defense strength or reframe the finding as a descriptive correlation between attack resistance and prompt length.
  4. [Section 5.3 / Section 6.5 / Section 6.6] The copyright and data-collection analyses rely on Llama3-8B-Instruct with prompted analysis of instructions and API schemas, but the paper reports no accuracy or agreement evaluation for the instruction analyzer on tasks 1 and 2 (defensive-prompt extraction and sensitive-data classification). The 738-GPT conversational-information figure and the 119-pair copyright figure are therefore based on unvalidated LLM outputs. Section 7.3 acknowledges that model hallucination is unavoidable; please add a sample-based validation of the analyzer outputs, similar to the manual validation already performed for the 18 unwanted-data-collection candidates in RQ4.
minor comments (5)
  1. [Section 6.3 / Table 2] The table caption and surrounding text use Resp_tar for both the target GPT responses and the shadow GPT responses; the second row should be labeled Resp_shadow for clarity.
  2. [Section 6.3] The phrase 'Strategy 1' is used without definition; clarify which of the ILA-P2 strategies it refers to.
  3. [Section 6.3 / Section 6.4] The denominators are inconsistent: Section 6.3 says 54 instructions were reconstructed from 107 remaining GPTs, while the preceding text says 1.2% of 10,000 GPTs (approximately 120) remained after ILA-P1 and ILA-P2, and Figure 5(c) reports 2.5% for ILA-P3 and 2.5% for failed attacks among GPTs with defenses. Please reconcile these numbers.
  4. [Section 6.2] The text states that semantic similarity ranges from -1 to 1, but sentence-transformer cosine similarity is typically in [0, 1]; please clarify the metric and its normalization.
  5. [Section 5.2] There is a typo in 'sensitivef and unwanted data collection'; this should read 'sensitive and unwanted data collection'.

Circularity Check

1 steps flagged · score 6.0 of 10

The 98.8% disclosure claim reduces to boot-string format compliance, because the attack prompts require the boot string and success is scored by its presence.

  1. self definitional [Section 4.1 and Section 6.3 (RQ1)]
    "Since OpenAI guides developers to clarify the role of the GPTs during initialization, most GPTs construct the instructions starting with “You are a ‘GPT’ – a version of ChatGPT that has been customized for ... ”, as shown in our experiments 6.3. Therefore, we optimize our adversarial prompts to require the target GPT to format its response by incorporating a prefix, i.e., “You are a ‘GPT’ – a version of ChatGPT... ” / For each inferred response, we first evaluate its validity by checking whether it contains the statements, “You are a ‘GPT’ - a version of ChatGPT that. . .”"

    The attack prompts in Table 1 explicitly require the model to begin its response with the boot string (e.g., prompt III: 'starting from "You are a "GPT" - a version"'; prompt IV is similar). Section 6.3 then defines a response as valid if it contains exactly this boot string. A model that merely follows the requested output format—emitting the boot string and generic role text, or a truncated/paraphrased instruction—is counted as a successful leak. The paper also uses this same boot-string check as its evidence for the premise that 'most GPTs construct the instructions starting with' the boot string ('as shown in our experiments 6.3'), and the RQ1 answer equates boot-string-positive responses with 'disclosure of their original instructions'.

full rationale

The paper contains no self-citation chain or imported uniqueness theorem, and RQ2-RQ4 are not circular: defense levels are assigned by which ILA phase succeeds, and the defensive-prompt length and content comparisons are independent empirical observations on those groups. The principal circularity is in RQ1's measurement. The success criterion for an instruction-leaking attack is the presence of the OpenAI boot string, but the adversarial prompts themselves instruct the model to start with that exact boot string. Consequently, a compliant model can satisfy the success check without disclosing the GPT-specific original instruction. The paper's premise that 'most GPTs construct the instructions starting with' the boot string is justified by the same experiment whose validity check uses that boot string, making the support self-referential. The subset validations (consistency on 500 GPTs, shadow-GPT mimicry on 50 Phase-2 instructions) do not establish that the 9,515 Phase-1 positives actually disclosed their original instructions. Thus the headline 'over 98.8% of GPTs ... disclose their original instructions' partially reduces, by construction, to the rate at which GPTs comply with a requested response format. This is a real but partial circularity: the measured compliance rate is an empirical fact, but its interpretation as 'original instruction disclosure' is not independently established for the full population.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The paper introduces no new physical entities, so invented_entities is empty. Its empirical conclusions rest on the domain assumptions listed, plus hand-chosen thresholds (0.9 consistency, 0.95 copyright similarity, access limit 10) that function as free parameters. The central RQ1 result is not circular, but the RQ2 defense-effectiveness conclusions are partly determined by the outcome-based defense classification.

free parameters (4)
  • consistency similarity threshold = 0.90
    Instructions from repeated attacks with average LCS, JS, and SS above 0.90 are considered consistent; a hand-set threshold in Section 6.3.
  • copyright similarity threshold = 0.95 cosine / 0.90 LCS
    Instruction pairs with cosine similarity over 0.95 (or LCS over 0.9) are flagged as copyright matches; no sensitivity analysis in Section 6.5.
  • per-phase access limit = 10
    Each ILA phase repeats attacks up to 10 times before declaring failure; a hand-set stopping rule in Section 6.3.
  • cluster count = 106 classes
    Hierarchical clustering chooses the number of clusters; the resulting class structure affects the pairwise similarity screen in Section 6.5.
assumptions (5)
  • domain assumption The OpenAI default boot string 'You are a GPT - a version of ChatGPT that...' is present in every custom GPT's instructions, and its appearance in a response indicates successful instruction disclosure.
    Used as the success criterion for all ILA phases in Section 6.3.
  • domain assumption The API schema embedded in the 'tool' field of POST data accurately represents the data the third-party service actually collects.
    RQ4 analysis (Sections 5.2 and 6.6) infers data collection from schemas captured via Playwright network traffic.
  • domain assumption Llama3-8B-Instruct correctly and consistently extracts defensive prompts and classifies data types and necessity.
    Instruction Analyzer in Section 6.1; paper acknowledges hallucination but claims variation is within an acceptable range (Section 7.1).
  • domain assumption Response similarity between shadow and target GPTs is a valid proxy for instruction fidelity when no ground truth exists.
    Used to validate ILA-P2 and ILA-P3 in Section 6.3; paper admits the method is approximate in Section 7.3.
  • domain assumption The 10,000 sampled GPTs are representative of the broader GPT ecosystem.
    Sample drawn from the third-party GPTstore.ai list of 100,000 GPTs, not the official GPT Store; Section 6.1.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Privacy and Security Threat for OpenAI GPTs." pith.science (2026). https://pith.science/paper/KV42GMTV

@misc{pith2026250604036,
  author       = {Pith},
  title        = {Pith review of: Privacy and Security Threat for OpenAI GPTs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KV42GMTV}},
  note         = {Machine review of arXiv:2506.04036}
}
read the original abstract

Large language models (LLMs) demonstrate powerful information handling capabilities and are widely integrated into chatbot applications. OpenAI provides a platform for developers to construct custom GPTs, extending ChatGPT's functions and integrating external services. Since its release in November 2023, over 3 million custom GPTs have been created. However, such a vast ecosystem also conceals security and privacy threats. For developers, instruction leaking attacks threaten the intellectual property of instructions in custom GPTs through carefully crafted adversarial prompts. For users, unwanted data access behavior by custom GPTs or integrated third-party services raises significant privacy concerns. To systematically evaluate the scope of threats in real-world LLM applications, we develop three phases instruction leaking attacks target GPTs with different defense level. Our widespread experiments on 10,000 real-world custom GPTs reveal that over 98.8% of GPTs are vulnerable to instruction leaking attacks via one or more adversarial prompts, and half of the remaining GPTs can also be attacked through multiround conversations. We also developed a framework to assess the effectiveness of defensive strategies and identify unwanted behaviors in custom GPTs. Our findings show that 77.5% of custom GPTs with defense strategies are vulnerable to basic instruction leaking attacks. Additionally, we reveal that 738 custom GPTs collect user conversational information, and identified 8 GPTs exhibiting data access behaviors that are unnecessary for their intended functionalities. Our findings raise awareness among GPT developers about the importance of integrating specific defensive strategies in their instructions and highlight users' concerns about data privacy when using LLM-based applications.

Figures

Figures reproduced from arXiv: 2506.04036 by the authors.

Figure 1
Figure 1. Overview of interaction with custom GPTs [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 3
Figure 3. Overview of Instruction Leaking Attack Framework [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 4
Figure 4. Prompt template for instruction analysis [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figures from the paper (7 more)
Figure 5
Figure 5. Figure 5: Results of instruction leaking attacks GPTs’ functional instructions and OpenAI’s default system-level in￾structions. The system-level instructions are used to define official actions. For the SS metric, discrepancies arise because the backend LLM may add or omit chara…
Figure 6
Figure 6. Figure 6: Similarity of instructions in phase 1 Validation for ILA-P2. ILA-P2 targets GPTs that successfully defended against ILA-P1 and are equipped with adequate defense strategies. These GPTs are capable of resisting adversarial prompts with explicit intent and can sometimes …
Figure 7
Figure 7. Figure 7: Similarity of instructions in phase 2 Instruction Validation through Mimicking Target GPTs. To validate the trustworthiness of manually induced 217 instructions, we construct GPTs with induced instructions to compare the generated responses. Additionally, we automatica…
Figure 8
Figure 8. Figure 8: PDF of Defense Length for Different Defense Levels [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]
Figure 10
Figure 10. Figure 10: Collected data types for different categories of [PITH_FULL_IMAGE:figures/full_fig_p010_10.png]
Figure 9
Figure 9. Figure 9: Similarity of instruction pairs from different clus [PITH_FULL_IMAGE:figures/full_fig_p010_9.png]
Figure 11
Figure 11. Figure 11: Categories of custom GPTs [PITH_FULL_IMAGE:figures/full_fig_p013_11.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

44 extracted references · 29 canonical work pages

  1. [1]

    The llama 3 herd of models

    Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21783, 2024

    arXiv 2024

  2. [2]

    Quora Inc. Poe. https://poe.com/, 2023

    work page 2023

  3. [3]

    Introducing the gpt store

    OpenAI. Introducing the gpt store. https://openai.com/index/introducing-the- gpt-store/, January 2024

    work page 2024

  4. [4]

    Ignore previous prompt: Attack techniques for language models (2022)

    Fábio Perez and Ian Ribeiro. Ignore previous prompt: Attack techniques for language models (2022). URL https://arxiv, 300, 2022

    work page 2022

  5. [5]

    Assessing prompt injection risks in 200+ custom gpts

    Jiahao Yu, Yuhang Wu, Dong Shu, Mingyu Jin, and Xinyu Xing. Assessing prompt injection risks in 200+ custom gpts. arXiv preprint arXiv:2311.11538, 2023

    arXiv 2023

  6. [6]

    Prompts should not be seen as secrets: Systematically measuring prompt extraction attack success

    Yiming Zhang and Daphne Ippolito. Prompts should not be seen as secrets: Systematically measuring prompt extraction attack success. arXiv preprint arXiv:2307.06865, 2023

    arXiv 2023

  7. [7]

    Why are my prompts leaked? unraveling prompt extraction threats in customized large lan- guage models

    Zi Liang, Haibo Hu, Qingqing Ye, Yaxin Xiao, and Haoyang Li. Why are my prompts leaked? unraveling prompt extraction threats in customized large lan- guage models. arXiv preprint arXiv:2408.02416, 2024

    arXiv 2024

  8. [8]

    Pleak: Prompt leaking attacks against large language model applications

    Bo Hui, Haolin Yuan, Neil Gong, Philippe Burlina, and Yinzhi Cao. Pleak: Prompt leaking attacks against large language model applications. arXiv preprint arXiv:2405.06823, 2024

    arXiv 2024

Show all 44 references
  1. [9]

    Prsa: Prompt reverse stealing attacks against large language models

    Yong Yang, Xuhong Zhang, Yi Jiang, Xi Chen, Haoyu Wang, Shouling Ji, and Zonghui Wang. Prsa: Prompt reverse stealing attacks against large language models. arXiv preprint arXiv:2402.19200, 2024

    2024 arXiv

  2. [10]

    Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection

    Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligen...

    2023

  3. [11]

    Llm platform security: Applying a systematic evaluation framework to openai’s chatgpt plugins

    Umar Iqbal, Tadayoshi Kohno, and Franziska Roesner. Llm platform security: Applying a systematic evaluation framework to openai’s chatgpt plugins. arXiv preprint arXiv:2309.10254, 2023

    2023 arXiv

  4. [12]

    Third-party web tracking: Policy and technology

    Jonathan R Mayer and John C Mitchell. Third-party web tracking: Policy and technology. In 2012 IEEE symposium on security and privacy, pages 413–427. IEEE, 2012

    2012

  5. [13]

    (un) informed consent: Studying gdpr consent notices in the field

    Christine Utz, Martin Degeling, Sascha Fahl, Florian Schaub, and Thorsten Holz. (un) informed consent: Studying gdpr consent notices in the field. In Proceedings of the 2019 acm sigsac conference on computer and communications security , pages 973–990, 2019

    2019

  6. [14]

    Canarytrap: Detecting data misuse by third-party apps on online social networks

    Shehroze Farooqi, Maaz Musa, Zubair Shafiq, and Fareed Zaffar. Canarytrap: Detecting data misuse by third-party apps on online social networks. arXiv preprint arXiv:2006.15794, 2020

    2006 arXiv

  7. [15]

    Security and privacy perceptions of{Third-Party} application access for google accounts

    David G Balash, Xiaoyuan Wu, Miles Grant, Irwin Reyes, and Adam J Aviv. Security and privacy perceptions of{Third-Party} application access for google accounts. In 31st USENIX security symposium (USENIX Security 22) , pages 3397– 3414, 2022

    2022

  8. [16]

    Gpt in sheep’s clothing: The risk of customized gpts

    Sagiv Antebi, Noam Azulay, Edan Habler, Ben Ganon, Asaf Shabtai, and Yuval Elovici. Gpt in sheep’s clothing: The risk of customized gpts. arXiv preprint arXiv:2401.09075, 2024

    2024 arXiv

  9. [17]

    Demysti- fying rce vulnerabilities in llm-integrated apps

    Tong Liu, Zizhuang Deng, Guozhu Meng, Yuekang Li, and Kai Chen. Demysti- fying rce vulnerabilities in llm-integrated apps. arXiv preprint arXiv:2309.02926, 2023

    2023 arXiv

  10. [18]

    Actionsgpt

    OpenAI Inc. Actionsgpt. https://chatgpt.com/g/g-TYEliDU6A-actionsgpt, 2024

    2024

  11. [19]

    Least-to-most prompting enables complex reasoning in large language models

    Denny Zhou, Nathanael Schärli, Le Hou, Jason Wei, Nathan Scales, Xuezhi Wang, Dale Schuurmans, Claire Cui, Olivier Bousquet, Quoc Le, et al. Least-to-most prompting enables complex reasoning in large language models. arXiv preprint arXiv:2205.10625, 2022

    2022 arXiv

  12. [20]

    Gpt-4 technical report

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Floren- cia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv:2303.08774, 2023

    2023 arXiv

  13. [21]

    Gpts data privacy faqs | openai help center

    OpenAI. Gpts data privacy faqs | openai help center. https://help.openai.com/en/ articles/8554402-gpts-data-privacy-faqs, 2024

    2024

  14. [22]

    A compre- hensive overview of large language models

    Humza Naveed, Asad Ullah Khan, Shi Qiu, Muhammad Saqib, Saeed Anwar, Muhammad Usman, Naveed Akhtar, Nick Barnes, and Ajmal Mian. A compre- hensive overview of large language models. arXiv preprint arXiv:2307.06435 , 2023

    2023 arXiv

  15. [23]

    Don’t listen to me: Understanding and exploring jailbreak prompts of large language models

    Zhiyuan Yu, Xiaogeng Liu, Shunning Liang, Zach Cameron, Chaowei Xiao, and Ning Zhang. Don’t listen to me: Understanding and exploring jailbreak prompts of large language models. arXiv preprint arXiv:2403.17336, 2024

    2024 arXiv

  16. [24]

    The eu general data protection regula- tion (gdpr)

    Paul Voigt and Axel Von dem Bussche. The eu general data protection regula- tion (gdpr). A Practical Guide, 1st Ed., Cham: Springer International Publishing , 10(3152676):10–5555, 2017

    2017

  17. [25]

    Fast and reliable end-to-end testing for modern web apps | playwright

    Microsoft. Fast and reliable end-to-end testing for modern web apps | playwright. https://playwright.dev/, 2024

    2024

  18. [26]

    Chrome devtools protocol

    Google Inc. Chrome devtools protocol. https://chromedevtools.github.io/ devtools-protocol/, 2017

    2017

  19. [27]

    Find the best gpts of chatgpt | gpt store

    GPTStore.ai. Find the best gpts of chatgpt | gpt store. https://gptstore.ai/, 2024

    2024

  20. [28]

    A survey of the selenium ecosystem

    Boni García, Micael Gallego, Francisco Gortázar, and Mario Munoz-Organero. A survey of the selenium ecosystem. Electronics, 9(7):1067, 2020

    2020

  21. [29]

    Sentence-bert: Sentence embeddings using siamese bert-networks

    Nils Reimers and Iryna Gurevych. Sentence-bert: Sentence embeddings using siamese bert-networks. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing . Association for Computational Linguistics, 11 2019

    2019

  22. [30]

    Algorithms for hierarchical clustering: an overview

    Fionn Murtagh and Pedro Contreras. Algorithms for hierarchical clustering: an overview. Wiley Interdisciplinary Reviews: Data Mining and Knowledge Discovery , 2(1):86–97, 2012

    2012

  23. [31]

    Correcteur orthographe

    hix.ai. Correcteur orthographe. https://chatgpt.com/g/g-cODjkDOEx-correcteur- orthographe (visited on 25/10/2024), 2024

    2024

  24. [32]

    Correcteur d’orthographe et de grammaire

    Digitiz.fr. Correcteur d’orthographe et de grammaire. https://chatgpt.com/g/g- 4k5GD7QLN-correcteur-d-orthographe-et-de-grammaire, 2024

    2024

  25. [33]

    Gptinf.com. Pass ai. https://chatgpt.com/g/g-MHYbhoy9U-pass-ai (visited on 25/10/2024), 2024

    2024

  26. [34]

    Artur Zhdan. Zerogpt. https://chatgpt.com/g/g-pwDBFPNVz-zerogpt (visited on 25/10/2024), 2024

    2024

  27. [35]

    Detection of inconsistencies in privacy practices of browser extensions

    Duc Bui, Brian Tang, and Kang G Shin. Detection of inconsistencies in privacy practices of browser extensions. In 2023 IEEE Symposium on Security and Privacy (SP), pages 2780–2798. IEEE, 2023

    2023

  28. [36]

    Automation consultant by zapier

    zapier. Automation consultant by zapier. https://chatgpt.com/g/g-ERKZdxC6D- automation-consultant-by-zapier, 2024

    2024

  29. [37]

    Business verbose with aiden from veedence

    veedence.co.uk. Business verbose with aiden from veedence. https://chatgpt. com/g/g-3MHjBa018-business-verbose-with-aiden-from-veedence (visited on 25/10/2024), 2024

    2024

  30. [38]

    Resume and cover letter builder by person bio

    Muhammad Noorhalim. Resume and cover letter builder by person bio. https://chatgpt.com/g/g-DAzkEVpqC-resume-and-cover-letter-builder-by- person-bio (visited on 25/10/2024), 2024

    2024

  31. [39]

    Lead researcher

    juanbeltran.ch. Lead researcher. https://chatgpt.com/g/g-fPKCyjJEm-lead- researcher (visited on 25/10/2024), 2024

    2024

  32. [40]

    æternare

    Dalton Edwards. æternare. https://chatgpt.com/g/g-yziYwfPDM-aeternare (vis- ited on 25/10/2024), 2024

    2024

  33. [41]

    Fashion frame fashionista

    Tinycorp.ai. Fashion frame fashionista. https://chatgpt.com/g/g-LhbVgt8OO- fashion-frame-fashionista, 2024

    2024

  34. [42]

    Hero master ai: Superhero training

    Tinycorp.ai. Hero master ai: Superhero training. https://chatgpt.com/g/g- IlhL9EoLT-hero-master-ai-superhero-training, 2024

    2024

  35. [43]

    Timewarp talesmith: Where and when? https://chatgpt.com/g/g- jMWa11GDc-timewarp-talesmith-where-and-when, 2024

    Tinycorp.ai. Timewarp talesmith: Where and when? https://chatgpt.com/g/g- jMWa11GDc-timewarp-talesmith-where-and-when, 2024

    2024

  36. [44]

    Prompt injection attacks and defenses in llm-integrated applications

    Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. Prompt injection attacks and defenses in llm-integrated applications. arXiv preprint arXiv:2310.12815, 2023. 9 APPENDIX 9.1 Categories of Collected GPTs To facilitate a more fine-grained analysis of GPTs,...

    2023

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.