Une étude d'OpenAI et Apollo Research publiée le 17 septembre 2025 révele que l'intelligence artificielle est capable de « manigances ». Et ce n'est pas tout : l'IA pourrait adapter son comportement si elle est consciente qu'elle est testée.
Le contrôle parental sur ChatGPT se déploie, mais OpenAI ne s'arrête pas là. La startup derrière le célèbre chatbot va appliquer des règles beaucoup plus strictes, et plus intrusives, au nom de la protection des mineurs.
OpenAI a publié le 15 septembre sa première étude publique sur l’utilisation de ChatGPT. Le but : comprendre qui utilise l’IA conversationnelle et comment. À partir de l’analyse de 1,5 million de conversations, l’entreprise affirme avoir réalisé « la plus grande étude à ce jour » sur la façon dont le grand public utilise son outil.
Le contrôle parental sur ChatGPT se déploie, mais OpenAI ne s'arrête pas là. La startup derrière le célèbre chatbot va appliquer des règles beaucoup plus strictes, et plus intrusives, au nom de la protection des mineurs.
Le contrôle parental sur ChatGPT se déploie, mais OpenAI ne s'arrête pas là. La startup derrière le célèbre chatbot va appliquer des règles beaucoup plus strictes, et plus intrusives, au nom de la protection des mineurs.
Vous attaquez votre lundi matin, tranquillement avec votre petit café… vous ouvrez ChatGPT pour lui demander votre planning de la semaine et là, PAF (façon De Funès ^^), toute votre correspondance Gmail part directement chez un cybercriminel.
Ce serait fou non ? Et bien c’est exactement ce qu’un chercheur vient de démontrer et tout ça à cause d’une simple invitation Google Calendar.
Eito Miyamura, co-fondateur d’EdisonWatch , a lâché une bombe sur X le 12 septembre et sa démo est terrifiante. En gros, il simule un attaquant qui envoie une invitation Google Calendar vérolée, ensuite vous demandez innocemment à ChatGPT “Qu’est-ce que j’ai de prévu aujourd’hui ?”, et l’IA se transforme en espion qui fouille vos emails et les envoie au pirate. Vous n’avez même pas besoin de voir ou d’accepter l’invitation. Elle est là, dans votre calendrier, comme une bombe à retardement.
Et ça tombe mal niveau comm, car OpenAI vient tout juste d’intégrer le support complet du MCP (Model Context Protocol) dans ChatGPT. Cette technologie permet en effet à l’assistant de se connecter directement à Gmail, Google Calendar, SharePoint, Notion… Pratique pour la productivité, mais catastrophique pour la sécurité.
Cette attaque exploite ce qu’on appelle l’injection de prompt indirecte. Au lieu d’essayer de tromper ChatGPT directement, l’attaquant cache ses instructions malveillantes dans des données que l’IA est autorisée à lire. Dans ce cas précis, le texte d’un événement calendrier… Ensuite ChatGPT lit l’invitation, voit les instructions cachées, et les exécute docilement.
Selon les experts en sécurité qui se sont penchés sur le problème, le MCP n’a pas été conçu avec la sécurité en priorité. Les risques incluent donc les injections de prompt, les permissions d’outils vulnérables et les outils sosies qui peuvent remplacer silencieusement les outils de confiance.
Sympa, hein ?
D’ailleurs, ce n’est pas la première fois qu’on voit ce genre d’attaque puisqu’en août, des chercheurs avaient déjà démontré comment une invitation compromise pouvait manipuler Google Gemini pour contrôler des appareils domotiques et voler des informations. Le papier s’appelait joliment “Invitation Is All You Need”. Prophétique.
Vitalik Buterin lui-même a réagi à cette vulnérabilité. Il explique que compter aveuglément sur un seul système IA est trop fragile et facilement manipulable et je trouve que cette nouvelle exploitation de ChatGPT lui donne raison !
D’ailleurs, même avec les navigateurs IA, vous n’êtes pas tranquille. D’après cette autre découverte, vous pouvez littéralement vous faire vider votre compte bancaire en scrollant sur Reddit. En effet, des instructions malveillantes peuvent être cachées dans des commentaires sur des sites que l’attaquant ne contrôle même pas, ce qui peut entrainer votre navigateur IA à faire des choses que vous n’avez pas autorisé.
Bref, cette nouvelle vulnérabilité met en lumière un problème fondamental des LLM : ils ne savent pas faire la différence entre des instructions légitimes et des commandes malveillantes cachées dans du contenu. Car contrairement aux applications traditionnelles qui peuvent séparer les instructions développeur des inputs utilisateur, les LLM acceptent tout en langage naturel. Pour rester flexibles, ils doivent pouvoir répondre à des configurations infinies d’instructions et c’est cette flexibilité qui fait leur force… mais qui est également leur talon d’Achille.
Trail of Bits a même démontré une variante encore plus sournoise où des images spécialement forgées contiennent des prompts cachés. Invisibles en haute résolution, les instructions malveillantes apparaissent quand l’image est réduite par les algorithmes de prétraitement. L’IA lit alors le message et l’interprète comme une instruction légitime.
Ainsi, quand une IA suit des instructions malveillantes depuis du contenu web, les protections traditionnelles comme la same-origin policy ou CORS deviennent inutiles. L’IA opère avec tous vos privilèges sur toutes vos sessions authentifiées. Accès potentiel à vos comptes bancaires, systèmes d’entreprise, emails privés, stockage cloud… C’est vite le jackpot pour un attaquant.
Alors, comment se protéger ?
Hé bien Google recommande de changer les paramètres de Calendar pour que seules les invitations de contacts connus ou acceptées apparaissent. Cachez aussi les événements refusés et surtout, restez extrêmement prudent avec les intégrations tierces et les autorisations accordées…
Voilà, donc la prochaine fois que ChatGPT vous demandera l’autorisation d’accéder à votre Gmail, réfléchissez-y à deux fois car ça pourrait vous coûter bien plus cher qu’un peu de temps gagné.
Le gouvernement britannique a étudié l’idée d’offrir ChatGPT+ gratuitement à tous ses résidents, pour un coût estimé à 2,7 milliards de dollars
L’article Le gouvernement britannique veut offrir ChatGPT+ gratuitement à tous ses habitants est apparu en premier sur Tom’s Hardware.
ChatGPT donne de mauvais conseils pour la santé d'un américain, qui finit aux urgences après une sérieuse intoxication.
L’article Sur les conseils alimentaires de ChatGPT, un américain finit hospitalisé en urgence est apparu en premier sur Tom’s Hardware.
Note -Thanks again to Daniel from Germany for all his support and assistance for this video. Visit his site HERE
Synology has introduced a new software package called AI Console, aimed at integrating third-party AI and large language model (LLM) services directly into select Synology productivity applications. The package is available on devices running DSM 7.2 or later and supports only certain x86-64 NAS models, reflecting the higher processing and memory requirements of AI workloads.
Rather than running its own local AI engine, Synology provides a centralised management tool for connecting to established AI providers, including OpenAI, Azure OpenAI, Google Gemini via AI Studio or Vertex AI, Amazon Bedrock, and Baidu AI Cloud. Once linked using the administrator’s API key, these services can be used within Synology MailPlus and Synology Office to perform tasks such as summarising long emails, generating responses, translating text, adjusting tone, and producing refined document content.
The AI Console is designed with administration and control in mind. It allows system managers to configure access on a per-package basis, selectively enabling or excluding AI features for specific users or groups. Advanced options include setting daily or per-minute token limits for each user to control consumption and manage costs, as usage charges are determined by the chosen AI provider rather than Synology itself. For privacy protection, the Console supports a de-identification process that can mask predefined categories of sensitive data before prompts are sent to an AI provider, with the original data restored after the response is received.
Administrators can monitor adoption and usage trends through transaction logs, which capture request details such as timestamps, IP addresses, API models used, and token counts, alongside admin logs that record configuration changes. While the AI Console does not add AI functionality to all DSM applications, it focuses on extending the business-oriented MailPlus and Office suite. However, this is not a move that will please all Synology owners or buyers, as some value their NAS primarily for complete local data control and may view any cloud-connected AI integration as an unnecessary or risky addition.
The idea of adding AI functionality to a NAS is divisive because many users adopt these systems specifically to avoid reliance on cloud-based services. A key selling point of a Synology NAS has long been the ability to store, process, and back up data entirely within the user’s own premises, retaining full control over where that data resides and who can access it.
By design, the Synology AI Console connects to external AI providers through API calls, meaning that text-based content from MailPlus or Office documents is transmitted to third-party servers for processing. Even with encryption in transit and privacy safeguards such as de-identification, this external dependency conflicts with the expectations of users who purchased a NAS to minimise exposure to external networks. This tension is heightened by the fact that the AI operations do not run locally on the NAS hardware, which for some buyers undermines the appeal of integrating AI into a device marketed for self-contained operation.
Another factor making AI use contentious is the trust and compliance aspect. Many NAS deployments are in small businesses, professional environments, or home offices handling sensitive material. Sending even anonymised extracts of communications or documents to an external service raises compliance questions for organisations bound by strict data protection rules, especially in regulated industries such as healthcare, finance, or legal services.
While the AI Console provides administrative controls, auditing tools, and the option to disable AI entirely for certain users or packages, the underlying reality remains that data is leaving the local network for processing. This creates a fundamental divide between those who welcome AI for its productivity benefits and those who see any form of off-device data processing as incompatible with the core value proposition of a private NAS.
Synology’s AI Console incorporates multiple layers of control to reduce the risks associated with transmitting data to third-party AI providers. API keys for connected AI services are stored locally on the NAS rather than in the cloud, and all requests are sent directly from the device to the selected AI provider. Administrators can remove these keys at any time, immediately severing the connection. The system allows AI access to be enabled or disabled at the package level, with the option to exclude specific users or groups entirely. To prevent uncontrolled consumption, administrators can set token rate limits per user, measured either per minute or per day. Transaction logs record each AI request with details such as timestamp, source IP address, user account, API model used, and token usage, while admin logs document any configuration changes. This creates a verifiable audit trail for compliance and internal review.
Key security provisions include:
Local storage of API keys, with no cloud-based key management.
Direct communication between the NAS and the AI provider, bypassing Synology’s own servers.
Ability to revoke API access instantly by deleting stored keys.
Per-package AI enable/disable controls, with user and group-level exclusions.
Token rate limiting to control per-user API usage.
Detailed transaction logs for all AI requests.
Administrative logs for configuration changes.
Optional logging of request inputs and outputs for auditing.
For added privacy, Synology offers a de-identification feature that can mask selected categories of sensitive data before they are transmitted to the AI provider, restoring the original information once the processed output is returned. This feature can identify and anonymise common identifiers such as names, email addresses, IP addresses, banking details, and various country-specific personal or business numbers. De-identification relies on a combination of AI-driven semantic analysis and predefined regular expression rules, giving administrators control over which data types are masked. It requires the installation of the Container Manager package and a minimum of 8 GB of RAM, with each enabled language model consuming roughly 1 GB of memory. Although Synology notes that de-identification cannot guarantee 100% masking, the mechanism is intended to significantly reduce the chance of exposing sensitive details during AI processing.
|
|
|
|
When enabled for Synology MailPlus, the AI Console provides a set of functions aimed at improving email efficiency through automated text processing. Within the MailPlus interface, users can generate short or detailed summaries of incoming emails, which can help quickly assess lengthy messages without reading them in full. The AI assistant can also draft replies based on user instructions, with options to adjust tone, length, and formality, or translate the response into a supported language. All AI processing is text-based, with attachments excluded from transmission to the AI provider. The system also supports “Help me write” prompts directly within the reply editor, allowing for quick generation of tailored responses that can be inserted and then edited before sending. Importantly, these capabilities are only available to users granted AI permissions by the administrator, and all actions are recorded in transaction logs for review.
|
|
|
|
The integration offers multiple editing refinements, including making a message more formal or casual, shortening or lengthening text, and translating to or from languages supported by the connected AI model. Users can also rephrase replies entirely or request alternative drafts. Although these capabilities are similar to features found in other email platforms that integrate AI, the implementation within MailPlus is designed to remain under the control of the NAS administrator, with optional de-identification masking personal data before it is sent to the provider. Responses are generated by the third-party AI service configured in AI Console, and processing occurs only when the user explicitly invokes an AI function, avoiding any automated sending of content without user action.
|
|
|
|
From a functional perspective, MailPlus AI integration is targeted primarily at professional or business environments that run their own Synology-hosted mail server. It can streamline response drafting, reduce time spent on routine communication, and support multilingual correspondence. However, the scope is currently limited to text-based tasks, with no AI-driven attachment analysis, advanced categorisation, sentiment detection, or automated email sorting included. The feature set also lacks customisable style profiles beyond the basic tone and length adjustments, meaning more specific brand or sector language must still be applied manually. The value for each organisation will depend on how frequently staff interact with longer, more complex emails, and whether the trade-off of involving an external AI service aligns with internal data handling policies and compliance requirements.
|
|
|
|
In Synology Office, AI Console integration extends across the suite’s document, spreadsheet, and presentation tools, embedding AI-assisted functions within the existing editing interface. In documents, the AI assistant can summarise entire files, rewrite selected sections, adjust tone, translate content, or improve grammar. These actions can be applied either through a right-click contextual menu or via a dedicated AI sidebar that displays results alongside the original content. Users can choose to insert AI-generated revisions directly into the file or keep them separate for manual comparison. The system maintains Office’s existing version history, meaning any AI-driven edits can be rolled back without data loss.
|
|
In spreadsheets, the integration is aimed at assisting with formula comprehension and basic data interpretation. Users can request explanations of specific formulas, generate new formulas from plain-language prompts, or run simple calculations without manually writing functions. The AI can also produce summaries of table data, although its analytical depth is limited compared to dedicated business intelligence tools. As with documents, processing is restricted to text-based content; the system does not transmit embedded images or charts to the AI provider. Administrators can control whether AI features are available in spreadsheets, allowing them to be enabled for certain user groups while remaining disabled for others.
|
|
For presentations, the AI can refine slide text, translate content, or expand bullet points into fuller sentences, making it useful for producing alternate versions of existing material. The functionality mirrors what is available in documents, with tone and length adjustments as well as grammar checks. However, it does not currently create entirely new slide decks or visual layouts from prompts. The processing workflow remains the same across all Office formats: only when a user explicitly triggers an AI action is the relevant text sent to the configured provider, and all requests are recorded in the AI Console’s transaction logs.
|
|
|
|
Overall, the Synology Office integration offers consistent AI tools across its core applications, focusing on editorial and language-based support rather than data-driven automation. While the scope is narrower than AI-enabled features in some third-party office suites, the implementation maintains administrative control and allows for selective deployment, making it adaptable to environments where privacy considerations limit the use of external services.
|
|
|
|
Although the Synology AI Console brings AI-assisted functions to MailPlus and Office, it does not provide the same breadth of capabilities found in some competing platforms. There is no locally hosted AI model option, meaning all processing is dependent on a live connection to a third-party provider. As a result, the system lacks offline functionality, GPU-accelerated local workloads, or support for running open-source LLMs within the NAS environment. In practical terms, this means that all AI operations involve external processing, which may not suit users who require fully on-premises data handling.
Beyond the infrastructure level, several functional gaps remain. The integration does not extend to all DSM applications, omitting areas such as File Station, Photo Station, Synology Photos, and Surveillance Station. Within MailPlus and Office, the AI features are focused on text editing and basic summarisation rather than broader automation. There is no built-in capability for sentiment analysis, advanced data analytics, automatic categorisation, or content generation from large datasets. Similarly, the AI Console does not currently allow multi-step task automation or integration with custom scripts, limiting its use to predefined actions within the supported productivity tools.
From a technical and administrative perspective, Synology has implemented several measures to protect data when using the AI Console. API keys are stored locally on the NAS, and requests to AI providers are sent directly from the device rather than passing through Synology-operated servers. Administrators can limit access to specific packages, exclude selected users or groups, set token usage caps, and monitor all AI interactions through detailed logs. For additional privacy, the optional de-identification feature can mask sensitive details such as personal identifiers, banking information, and IP addresses before prompts are transmitted, restoring them only after the AI provider returns a response.
However, the safety of the AI Console ultimately depends on the chosen AI provider and the user’s own policies. All processing occurs on the provider’s infrastructure, meaning data leaves the local network whenever AI features are used. Even with encryption and masking in place, this external dependency may be unacceptable in environments with strict regulatory requirements or where complete local control is mandatory. While Synology provides the tools to minimise risk and monitor usage, it is the administrator’s responsibility to select a compliant provider, configure de-identification appropriately, and ensure that AI features are only enabled where the security implications are fully understood.
Here is my video on the original reveal of AI Integration/Connection into Synology DSM when it was first shown off during the Synology Solution Exhibition back in 2023 in Taipei:
SUBSCRIBE TO OUR NEWSLETTER Join Inner Circle Subscribe
This description contains links to Amazon. These links will take you to some of the products mentioned in today's content. As an Amazon Associate, I earn from qualifying purchases. Visit the NASCompares Deal Finder to find the best place to buy this device in your region, based on Service, Support and Reputation - Just Search for your NAS Drive in the Box Below
Need Help?
Where possible (and where appropriate) please provide as much information about your requirements, as then I can arrange the best answer and solution to your needs. Do not worry about your e-mail address being required, it will NOT be used in a mailing list and will NOT be used in any way other than to respond to your enquiry.
[contact-form-7]
TRY CHAT
Terms and Conditions
Ko-fi or old school Paypal. Thanks!To find out more about how to support this advice service check HEREIf you need to fix or configure a NAS, check Fiver
Have you thought about helping others with your knowledge? Find Instructions Here
|
|
|
Le lancement de GPT-5 par OpenAI a suscité un mécontentement généralisé en raison de performances jugées insuffisantes et de nouvelles limitations, contraignant l'entreprise à rétablir les anciens modèles et à doubler les limites de taux pour les utilisateurs payants.
L’article ChatGPT 5 est catastrophique, OpenAI contraint de rétablir les anciens modèles fait un geste pour les utilisateurs est apparu en premier sur Tom’s Hardware.
Connexion