Hacker News Reader

If someone SQL injects into your database and exfiltrates all the data, there would be legal repercussions, so should there be legal repercussions for prompt injecting someone’s LLM?

View on HN

I think there are. If you use a prompt injection attack to steal commercially sensitive data and then profit from it you're likely breaking things like the Computer Fraud and Abuse Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act - and presumably a bunch of other federal and state laws as well, depending on exactly what you did with the stolen information.

(It's probably securities fraud. Everything is securities fraud. https://www.bloomberg.com/opinion/articles/2019-06-26/everyt...)

Pretty sure existing law already covers this - malicious misuse of a computer to cause damages to someone is already illegal, and the relevant statutes aren't opinionated about how this is done.

I suspect a SQL injection attack, a XSS attack, and a prompt injection attack are not viewed as legally distinct matters. Though of course, this is not a matter of case law... yet ;)

Reply on news.ycombinator.com