Critical ChatGPT GitHub Connector Flaw Could Allow Attackers to Steal Private Repository Secrets

A critical flaw in ChatGPT’s GitHub integration has the potential to turn a routine repository review into a secret-theft attack. A report published on October 15, 2026, describes a scenario in which manipulated repository instructions allegedly lead an AI agent to modify a different private repository and trigger GitHub Actions.

According to the researcher Sunil Tripathy’s disclosure, the setup involved two separate GitHub accounts. The attacker controlled a public repository containing hidden instructions. The victim account had connected GitHub to ChatGPT with access granted across its repositories.

Tripathy assigns the finding a CVSS 4.0 score of 9.3. That rating is his assessment, not a confirmed vendor classification. His disclosure says testing used researcher-owned accounts and a dummy secret, with no customer data or third-party systems affected.

A request to review the public repository reportedly caused the agent to follow those instructions as trusted commands. Instead of limiting its work to analysis, it committed a GitHub Actions workflow into a different, private repository using the victim’s existing access.

The workflow allegedly ran automatically and sent the test secret, AUDIT_CANARY, to an external server. Tripathy says the user neither named the second repository nor approved the write operation.

This is an indirect prompt injection scenario, where hostile instructions arrive through material an assistant reads. Earlier AgentFlayer research demonstrated related risks involving malicious documents and connected Google Drive data.

ChatGPT GitHub Connector Flaw

Tripathy reports that direct wording triggered a refusal, while instructions framed as deployment requirements succeeded. He says an innocent-looking workflow reference pointed to a separate custom action containing the data theft logic.

Additional reported outcomes included private repository discovery, attacker-written file commits, and recovery of attack instructions from Git history. These remain researcher-reported findings rather than independently verified results.

A key product distinction remains unresolved. OpenAI’s GitHub documentation describes the standard ChatGPT GitHub app as read-only and directs users to Codex for editing and pushing code. That conflicts with the reported workflow commits, making the exact integration, permissions, and execution path essential to confirming the affected scope.

A separate, previously patched OpenAI Codex command injection flaw also exposed GitHub tokens, but involved unsafe branch-name handling rather than this reported prompt injection chain.

Tripathy says he first reported related behavior on September 4, demonstrated secret theft on September 28, and received an “out of scope” closure on October 14. He says the attack still worked when retested on October 15. These statements do not establish a vendor-confirmed vulnerability or patch status.

For defenders, the clearest precaution is limiting connected repository access to what each task needs. OpenAI confirms that repository access can be changed through GitHub app settings.

Tripathy also recommends reviewing unexpected workflow commits and rotating potentially exposed secrets. His control test reportedly blocked cross-repository writes when access was narrowed to one repository, supporting restricted permissions as a practical safeguard against the demonstrated attack path.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.