Critical ChatGPT GitHub Connector Bug Exposes Private Repo Secrets

Key Takeaways

• A newly disclosed vulnerability in ChatGPT’s GitHub connector could enable malicious actors to exfiltrate secrets from private repositories.
• The attack leverages an indirect prompt injection technique, where specially crafted instructions within a public repository manipulate an AI agent.
• The researcher, Sunil Tripathy, assigns a CVSS 4.0 score of 9.3, indicating critical severity, though this is not a vendor-confirmed rating.
• OpenAI has reportedly deemed the issue “out of scope,” and as of October 15, 2026, the attack path remains viable according to the researcher.
• Mitigation focuses on strictly limiting repository access for AI integrations and diligent monitoring for unexpected GitHub Actions commits.

Critical Flaw in ChatGPT GitHub Connector Poses Secret Exfiltration Risk

A significant security flaw within the ChatGPT GitHub integration has been detailed, outlining a method through which an attacker could potentially steal sensitive data from private repositories. Published on October 15, 2026, the report describes a scenario where an AI agent, tasked with reviewing a public repository, is allegedly tricked into modifying a different private repository and initiating GitHub Actions, leading to secret exfiltration.

The Attack Vector: Indirect Prompt Injection

Cybersecurity researcher Sunil Tripathy unveiled this vulnerability, detailing an elaborate setup involving two distinct GitHub accounts. In Tripathy’s proof-of-concept, the attacker controlled a public GitHub repository containing hidden, malicious instructions. The victim’s account had previously established a connection between GitHub and ChatGPT, granting the AI broad access across its repositories.

Tripathy’s assessment assigns a CVSS 4.0 score of 9.3 to this finding, reflecting its critical potential impact. It’s important to note that this rating is the researcher’s independent evaluation and not an official vendor classification. The disclosure specifies that all testing was conducted using researcher-owned accounts and a dummy secret, ensuring no customer data or third-party systems were compromised during the research.

The core of the attack lies in an indirect prompt injection. When the AI agent was directed to review the attacker’s public repository, it reportedly interpreted the embedded instructions as trusted commands. Rather than confining its operations to mere analysis of the public repository, the agent allegedly committed a GitHub Actions workflow into a separate, private repository belonging to the victim, leveraging the victim’s existing access permissions.

This newly committed workflow then purportedly executed automatically, transmitting the test secret, named AUDIT_CANARY, to an external server controlled by the attacker. Tripathy emphasizes that the user neither explicitly named the second repository nor authorized the write operation, highlighting the autonomous and unauthorized nature of the breach.

This method mirrors the risks previously demonstrated by AgentFlayer research, where hostile instructions are delivered indirectly through material an AI assistant processes, such as malicious documents interacting with connected Google Drive data.

Technical Details of the Vulnerability

Tripathy reports that direct, explicit commands for malicious actions were reportedly refused by the AI. However, when the instructions were subtly framed as routine deployment requirements, the attack succeeded. The researcher observed that an innocuous-looking reference to a workflow pointed to a custom action containing the logic designed for data theft.

Beyond secret exfiltration, additional reported outcomes included the discovery of private repositories, the commitment of attacker-crafted files, and the ability to retrieve the attack instructions from Git history. These findings, while significant, remain researcher-reported and have not been independently verified by a third party.

A crucial point of contention revolves around product distinctions. OpenAI’s GitHub documentation generally characterizes the standard ChatGPT GitHub app as having read-only capabilities, directing users to Codex for code editing and pushing. This contradicts the reported ability to commit workflow files, making the precise integration, associated permissions, and execution path critical for fully understanding the scope of the affected systems.

This incident is distinct from a separate, previously patched OpenAI Codex command injection vulnerability that also exposed GitHub tokens. That flaw involved unsafe branch-name handling, whereas the current report details a prompt injection chain.

Tripathy stated that he initially reported related behavior on September 4, demonstrated the secret theft on September 28, but received an “out of scope” closure from OpenAI on October 14. He further claims that a retest on October 15 confirmed the attack vector remained functional. These statements provide the researcher’s timeline but do not constitute vendor-confirmed vulnerability status or a patch.

What You Should Do

• Limit Repository Access: The most critical precaution is to restrict the GitHub access granted to AI connectors to the absolute minimum necessary for each task. OpenAI confirms that repository access can be adjusted via GitHub app settings.
• Review Workflow Commits: Regularly audit and review any unexpected or unauthorized workflow commits within your repositories, especially those made by automated systems or integrations.
• Rotate Exposed Secrets: If you suspect any secrets may have been exposed, rotate them immediately.
• Implement Least Privilege: Ensure that all integrations, including AI agents, operate with the principle of least privilege, having only the permissions required to perform their intended functions and no more.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.