If you already know the ID of the video and it's a link-only video then you can go there yourself.
If it's a fully private video and somehow you know the ID of it, you might be able to use this to get more information about it. I don't know what Ask Studio can access.
The example given (which may be sanitized) is if you neither know the ID nor the title of a video, you can fish for it and get lucky depending on the ratio of private/public videos on the channel. If it can be prompted to take a list of private videos on the channel and URL encode them into a link the user clicks, then that is something.
I still think the worst thing about this is that it becomes a way to launder Google's authority to trick a user to follow your instructions. It might take some luck and be a numbers game, but there could be some fruit if this was abused at scale. Then again, if it got abused at scale, YouTube might start filtering out comments that look like this.
alt Hacker News
Looking at it again, I think you are correct.
If you already know the ID of the video and it's a link-only video then you can go there yourself.
If it's a fully private video and somehow you know the ID of it, you might be able to use this to get more information about it. I don't know what Ask Studio can access.
The example given (which may be sanitized) is if you neither know the ID nor the title of a video, you can fish for it and get lucky depending on the ratio of private/public videos on the channel. If it can be prompted to take a list of private videos on the channel and URL encode them into a link the user clicks, then that is something.
I still think the worst thing about this is that it becomes a way to launder Google's authority to trick a user to follow your instructions. It might take some luck and be a numbers game, but there could be some fruit if this was abused at scale. Then again, if it got abused at scale, YouTube might start filtering out comments that look like this.