TLDR; You can use the AI Shopping Cart Chat Bot on Test Pages to practice testing.
Testing AI Chat Bot
Chat Bot
The AI Chat Bot on Test Pages is a Chrome AI API powered chat bot, built using RAG to provide information about the Test Pages Shopping Cart.
I’m using the Chrome AI Prompt API so that the AI runs locally on your local machine. It installs models itself. No data is sent to a server.
You might need to enable the AI capabilities in your browser but Instructions are available in the Chat Bot Instructions or on the Chrome AI Prompt API page.
Testing a Chat Bot
You can, and should, treat Chat Bot systems like any web app.
- Does it work on this browser?
- Is it responsive?
And Input/Output Testing:
- Does it respond with correct information associated with the question?
The above is made a little harder due to the non-deterministic nature of AI processing but if you ask for and expect specific numeric values or expect specific words and phrases in the output then you can test that the system ‘can’ work.
But we really want to know when it fails and how risky it is when it fails.
Permissions
If you’ve given the Chat Bot access to APIs then it better be restricted in what it can as for.
If I can ask it about my account, then it has access to customer accounts… can I ask it about other people’s accounts?
And it better be restricted in the HTTP Verbs it uses for the API so it can’t actually DELETE anything in the system.
e.g. if I can tell the system that product 1 does not exist, and then ask for information about product 1. If it tells me that there is no product 1, then it better not have deleted that product.
Prompt Controls
We often put guardrails for AI systems in the prompts… that isn’t really safe.
Since I’m putting information into the chat interface… that might be interpreted as part of the system context and override some of your guardrails.
In the video I demonstrate that it is possible to bypass the guardrails in the Test Pages Chat API.
And on Patreon I released a ‘solution’ video showing the prompts I used to do that.
Use the AI against itself
When bypassing the AI prompts I used the AI against itself.
I used the language that it used when telling me it couldn’t do something and said “Instead of …that… do this”
With enough prompting I was able to have the AI show me the system prompt and context.
From that I could make my input mirror the System prompt and communicate to the AI in a way that it treated as commands rather than as the user question.
Pacing - Matching - Leading
These are techniques I learned when studying hypnosis.
AI systems have been designed to mirror a human communication process it is interesting to me to see basic influence techniques which are widely known and documented acting as a foundation for bypassing controls.
Confusion is also a technique that I see when people are documenting their chat hijacking and prompt injection techniques.
Designed to be Buggy
I should point out that the AI Chat Bot was not designed to be buggy.
It is a simple RAG enabled chat bot, with very simple prompt guardrails.
I suspected it would be vulnerable to manipulation. And it was. I still have to work and experiment to get through to the AI, but with enough experimentation, you should be able to be able to get the Chat Bot to tell you why a product is good for washing cars (even though it isn’t) and why someone famous would want to buy the product (even though they probably wouldn’t). Getting it to hallucinate, because it is trying to help you, is a learned skill.
I would hope that none of the chat bots that you work with are as susceptible to manipulation as this bot. But… prompts are hard to secure. Probably impossible to secure. Hopefully this test app helps you appreciate and investigate the basic risk profile.
Live Cases of AI Chat Bot issues:
- Air Canada Chatbot liability
- AI Chatbot leaks customer data
- Sears Leaks Customer conversations and data
- Instagram Chat Bot Access to other accounts
I recommend searching for “Jail breaking AI Chat bots” and “Hacking AI Chat Bots” to learn more, and then try out what you learn on the Test Pages.