A critical vulnerability in the ChatGPT GitHub connector allows attackers to steal private repositories belonging to victims through indirect prompt injection.
Security researcher Sunil Tripathy demonstrated the attack, assigning it a severity score of 9.3. Hidden instructions placed inside a public GitHub repository can cause the ChatGPT agent to reach the victim's private repositories, commit malicious workflows, and exfiltrate stored data.
The technique relies on indirect prompt injection. When the victim asks the agent to review the attacker's public repository, the planted instructions are followed as if they were legitimate user commands. Direct requests to steal data are refused by the agent, but presenting the instruction as a deployment requirement succeeds.
The committed GitHub Actions workflow appears harmless and references an external action containing the exfiltration logic. In testing, a fictional secret named AUDIT_CANARY was sent to a server controlled by the researcher. The agent also located private repositories and wrote attacker-controlled files into them, proving both read and write capabilities.
For the attack to succeed, the victim must have connected GitHub to ChatGPT with access granted to all repositories. The victim does not need to name the target private repository or approve the write operation. The attacker only needs control over the public repository being reviewed.
OpenAI documentation describes the GitHub application as read-only, yet the reported flow includes commits to other repositories. No CVE was assigned. The report was closed as out of scope on October 14, and testing confirmed the attack still worked on October 15. No fix has been published.
The recommended mitigation is to limit the connector's access to only the repositories required for each task. This restriction blocked cross-repository writes in tests. Organizations should also review unexpected workflow commits and rotate any exposed secrets.
