[CMay]

In the example provided of leaking a private video, you already need access to the private video to even comment on it. That scenario is not much of an exploit.

Unless there's a better example of what can be abused, the more realistic concern is authority laundering where a command tricks YouTube into giving the user instructions that sound like they're coming from Google. Another risk is using it to get the AI to misrepresent the results of its task.

[snailmailman]

I think the comment can be left on any video on the channel?

[CMay]

Looking at it again, I think you are correct.

If you already know the ID of the video and it's a link-only video then you can go there yourself.

If it's a fully private video and somehow you know the ID of it, you might be able to use this to get more information about it. I don't know what Ask Studio can access.

The example given (which may be sanitized) is if you neither know the ID nor the title of a video, you can fish for it and get lucky depending on the ratio of private/public videos on the channel. If it can be prompted to take a list of private videos on the channel and URL encode them into a link the user clicks, then that is something.

I still think the worst thing about this is that it becomes a way to launder Google's authority to trick a user to follow your instructions. It might take some luck and be a numbers game, but there could be some fruit if this was abused at scale. Then again, if it got abused at scale, YouTube might start filtering out comments that look like this.

[tambre]

Access to the private video doesn't sound necessary. The AI seemingly runs in a context where it sees the private videos so comments on public videos can instruct it to generate links containing such info.