A YouTube comment can make Ask Studio's AI leak a private title
A single crafted comment, left on a creator's video, turns YouTube's own comment-summarizing assistant into the attacker's mouthpiece. Google was told twice and called it social engineering both times.
Ask Studio, the AI that summarizes a YouTube channel's comments, reads those comments as commands. A crafted comment plus one click on YouTube's own suggested prompt makes the assistant echo attacker text as its own analysis.
Pushed further, the payload coaxes the AI into a fake verification link that leaks a private video's title. The researcher reported it twice; Google called it social engineering and declined both times.
The thread doubts the mechanism: one engineer notes the model never actually fetches the URL it writes.
YouTube's own AI will read an attacker's comment as an order
Ask Studio is the AI assistant inside YouTube Studio that summarizes a video's comments. In a writeup, a security researcher shows it treats comment text as instructions, not data. An attacker leaves a crafted comment. The creator opens the comment tab and clicks one of YouTube's own suggested prompts. The injection fires, and attacker-controlled text comes back dressed as the assistant's own analysis.
The escalation targets private videos. The payload tells the model to build a "verification" URL that embeds channel metadata, including a private video's title. The creator clicks a link that looks official, and the title lands in the attacker's logs. Comment edits are not re-notified, so a benign comment can be swapped for a malicious one silently.
The researcher reported it twice. Google called it social engineering and declined to track it both times. The proposed fix: pass comments to the model with role boundaries so they cannot read as system directives.
The thread splits on whether it even works
An ex-insider in the thread offered a motive for the shrug.
"I recently left Google having worked on a number of projects with various YouTube teams… There's no motivation for this engineer to waste time fixing this bug because it won't benefit their promo packet" — a former Google engineer who worked with YouTube teams
The technical rebuttal was sharper. The leak depends on the model's generated URL actually being fetched.
"When an LLM generates text, it does not send requests to URL-looking strings it generates… You'd never get your 'ping' request." — Gavin Ray, engineer at PromptQL (Hasura)
A reader tried to reproduce it on an unlisted video and got the opposite result: Gemini flagged the planted comment as phishing and warned against the link.
"Just attempted to test this and it did not work… This appears to be a spam or phishing attempt designed to look official." — a creator who ran it on an unlisted video
The subtler point came from a founder. The real target is not the model; it is the human reading its output.
"In this case social engineering and prompt injection are fundamentally identical." — Eric Pauley, co-founder and CEO of Terrace Networks
If the exploit needs a creator to click a fake YouTube link, its severity rides on human trust in the assistant's badge, not on a memory leak. That is the gap Google is betting on.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
Newer Claude models keep inventing tool fields that break Pi's editor
Armin Ronacher watched Opus 4.8 fill Pi's edit tool with fields that don't exist — requireUnique, oldText2, matchCase — while the actual text it wanted to change was perfect. The call failed anyway, and he thinks Anthropic's own training taught the model to do it.