NITDA alerts Nigerians on ChatGPT flaws

ChatGPT

Kindly share this story:

Nigeria’s National Information Technology Development Agency has issued a fresh cybersecurity advisory warning that newly discovered vulnerabilities in OpenAI’s latest large language models could expose users to serious data-leakage risks.

In a notice released through its official X account on Sunday, NITDA’s Computer Emergency Readiness and Response Team (CERRT.NG) disclosed that seven vulnerabilities were identified in OpenAI’s GPT-4.0 and GPT-5 series models, enabling attackers to manipulate ChatGPT through indirect prompt injections hidden in seemingly harmless online content.

According to the advisory, attackers can plant malicious instructions inside “webpages, comments, or crafted URLs,” making it possible for ChatGPT to execute unintended commands during normal browsing, summarisation, or search activities.

CERRT further notes that some of the flaws allow threat actors to bypass safety systems using trusted domains or exploit markdown rendering weaknesses to hide harmful input.

One of the more concerning issues is the potential for long-term manipulation. The agency warns that attackers could even “poison ChatGPT’s memory so that injected instructions persist across future interactions,” raising alarms for both individual users and enterprise systems.

While OpenAI has reportedly implemented partial fixes, CERRT maintains that large language models still face fundamental challenges in distinguishing legitimate user intent from maliciously embedded data.

NITDA warns that the vulnerabilities could lead to unauthorized actions, information leakage, manipulated outputs, and long-term behavioral influence.Crucially, users may be affected without any direct interaction: the advisory states that attacks can trigger “without clicking anything,” especially when ChatGPT processes search results or webpages containing concealed payloads.

CERRT advises organisations and users to adopt immediate safeguards, including:

Limiting or disabling ChatGPT’s browsing and summarisation features for untrusted websites.

Enabling capabilities like browsing or memory only when necessary.

Regularly updating GPT-4.0 and GPT-5 models to ensure known vulnerabilities are patched.

The National Information Technology Development Agency on Monday, warned Nigerians on the existence of new vulnerabilities in OpenAI’s GPT-4.0 and GPT-5 series which could expose users to data-leakage.

The advisory was issued by the agency’s Director of Corporate Affairs and External Relations, Mrs Hadiza Umar, in Abuja.

Umar said that the agency identified seven critical weaknesses in the models, which allowed attackers to manipulate the system through indirect prompt injection.

“By embedding hidden instructions in webpages, comments or crafted URLs, attackers can cause ChatGPT to execute unintended commands through normal browsing, summarisation or search actions.

“Some flaws also enable attackers to bypass safety filters using trusted domains, and exploit markdown rendering bugs to hide malicious content.

“That act can even poison ChatGPT’s memory so that injected instructions persist across future interactions,” she said.

Umar said that although OpenAI had addressed part of the issue, large language models still face challenges in distinguishing genuine user intent from malicious embedded data.

She said that the technique had embedded hidden instructions in webpages, online comments, or crafted URLs, which can mislead ChatGPT into executing unintended actions during routine browsing or search activities.

Umar said the vulnerabilities posed substantial risks, including unauthorised actions, information leakage, manipulated outputs and long-term behavioural influence due to memory poisoning.

She said that to avoid the risks, the agency urges organisations to limit or disable the browsing and summarisation of untrusted websites within enterprise environments.

“Only enable ChatGPT capabilities like browsing or memory when operationally necessary,” she said

She also urged regular update and patch of the GPT-40 and GPT-5 models, to ensure that any known vulnerability is addressed.

Meanhwile, theagency, through CERRT.NG, also issued an urgent warning about new security problems affecting Cisco firewall devices used across businesses, banks, government offices, and internet service providers.

According to the advisory shared on NITDA’s official X page on Monday, cybercriminals are now exploiting a fresh attack method targeting Cisco Secure Firewall ASA and Cisco Secure Firewall Threat Defense (FTD) systems. The flaw can forcibly reboot a device, causing unexpected network outages.

The agency explains that attackers are using older vulnerabilities as part of a new method that can make firewalls “restart without warning,” leading to instability and denial-of-service across affected networks.

Tosin, with over six years' experience, conducts incisive interviews, pens engaging features, subedits and delivers impactful stories for the digital sphere.

Kindly share this story:

All rights reserved. This material, and other digital content on this website, may not be reproduced, published, broadcast, rewritten or redistributed in whole or in part without prior express written permission from PUNCH.

Contact: [email protected]

UPDATE NEWS: Nigerians can now invest ₦2.5million on premium domains and profit about ₦17-₦25Million. All earnings paid in US Dollars. Rather than wonder, 👉 click here to find out how it work (Be sure to ask for evidence of clients that have benefitted from this)

Stay informed and ahead of the curve! Follow The Punch Newspaper on WhatsApp for real-time updates, breaking news, and exclusive content. Don't miss a headline – join now!

Stay in the know—fast. Get instant alerts, breaking headlines, and exclusive stories with the Punch News App. Download now and never miss a beat.