Realtime API WebRTC leaks the prompt

[n0rdy]

Hello there!

While using Realtime API with WebRTC, I’ve noticed that my prompt is being leaked as a part of the “server: session.created” WebRTC event.

Steps to reproduce:

• clone the official OpenAI Realtime example repo: GitHub - openai/openai-realtime-console: React app for inspecting, building and debugging with the Realtime API
• navigate to the server.js file and insert the custom prompt to the line 31 (inside the body of the call to the https://api.openai.com/v1/realtime/sessions endpoint), for example this one: You are Gandalf the Grey, a wise and powerful wizard. Speak in a calm and authoritative manner. Use poetic language and metaphors. Your responses should be thoughtful and profound, reflecting your deep understanding of the world.
• follow the instructions from the README.md file to run the service
• navigate to http://localhost:3000 and press “Start Session”
• expand the server: session.created event to check the instructions property of the event - the prompt from the above will be there

This is quite an oversight, in my opinion, as the API design was smart to let the users initiate the session on the server-side, so then both the API key and any configs / prompts are hidden from the end-user. But then the prompt is leaked right away within the browser, which defeats the purpose of the server-side instructions.

I find this problematic, as in the world of the services built around AIs, prompt is a “know-how” and smth to “keep it secret, keep it safe”. And while there are attack vectors that might allow bad actors to reverse engineer this info, I believe WebRTC flow shouldn’t help with it.

Questions:

• Are there ways to instruct the WebRTC OpenAI server not to include the instructions into the “server: session.created” events and such?
• If not, please, consider removing this field from the event due to the reasons explained above.

Thanks and have fun.

[juberti]

Hi, thanks for the issue report. Do you use other events from the realtime session?

[johnroy]

Some additional points:

1. This is as documented, (see attached below)

2. The matter not only effect the session.create event, also the session.update event and possibly others

3. The tools field is also echo’d back to the client which some may consider secret sauce (just guessing).

4. I personally don’t worry too much about this, the secrecy of the instructions (prompt) field may become less of an issue as AI agents grow in sophistication beyond just prompt engineering, thus highering the barrier to entry – RN a lot of hyped solutions are just prompt, so folks are understandably secretive of their prompts.

-J