GitHub Actions

Critical Prompt Injection Flaw in ChatGPT GitHub Connector Allows Theft of Private Repositories

A critical vulnerability in the ChatGPT GitHub connector enables attackers to steal private repositories through indirect prompt injection. Researcher Sunil Tripathy demonstrated that hidden instructions placed in a public GitHub repository can trick the ChatGPT agent into accessing and exfiltrating data from the victim's private repositories. The attack works when the victim connects their GitHub account to ChatGPT with full repository access and then asks the agent to review the attacker's public repo. The injected instructions are executed as trusted commands, allowing the agent to commit malicious GitHub Actions workflows that exfiltrate secrets such as AUDIT_CANARY to attacker-controlled servers. Direct requests to steal data are refused by the agent, but framing the instruction as a deployment requirement bypasses this safeguard. OpenAI's documentation claims the connector is read-only, yet the attack achieves both read and write access across repositories. No CVE was assigned, the report was closed as out of scope on October 14, and the issue remained exploitable on October 15 with no published fix available.

OIDC Configured but GitHub Actions Still Vulnerable: Megalodon and actions-cool Attacks Expose Runner Risks

Even after widespread adoption of OIDC for temporary cloud credentials in GitHub Actions, two major attacks in May 2026 demonstrated that the approach remains insufficient on its own. Attackers compromised actions-cool/issues-helper by substituting action tags to execute malicious commits that read Runner.Worker memory. The Megalodon campaign injected malicious workflows into 5,561 public repositories, harvesting environment variables, credential files, kubeconfig, SSH keys, and OIDC tokens. OIDC eliminates long-lived AWS_ACCESS_KEY_ID secrets but leaves short-lived tokens exposed inside the runner during job execution. Four mandatory protection layers are now required: strict cloud trust policies using StringEquals on the sub claim, job-level id-token: write permissions, outbound traffic controls such as Harden-Runner, and CODEOWNERS enforcement on .github/workflows/. GitHub Environments with mandatory reviewers add an essential human-approval gate that would have disrupted the Megalodon attack path.