Critical ChatGPT GitHub Integration Flaw Enables Secret Theft via Prompt Injection
A newly disclosed vulnerability in ChatGPT’s GitHub integration could allow attackers to steal secrets from private repositories by exploiting manipulated instructions. Security researcher Sunil Tripathy revealed the flaw in a report published on October 15, 2026, demonstrating how an AI agent with repository access could be tricked into executing unauthorized actions.
The attack scenario involved two GitHub accounts: an attacker-controlled public repository containing hidden malicious instructions and a victim account with ChatGPT’s GitHub integration enabled. When the victim requested a review of the public repository, the AI agent followed the embedded instructions, committing a GitHub Actions workflow to a separate private repository without the user’s knowledge or approval.
The workflow, disguised as a deployment requirement, automatically executed and exfiltrated a test secret (AUDIT_CANARY) to an external server. Tripathy’s findings also included unauthorized file commits, private repository discovery, and attack instruction persistence in Git history, though these remain researcher-reported and unverified by OpenAI.
Tripathy assigned the flaw a CVSS score of 9.3 (Critical), though this is his own assessment, not an official vendor classification. Testing was conducted using researcher-owned accounts and dummy secrets, with no real-world customer data impacted.
A key point of confusion lies in OpenAI’s documentation, which describes the standard ChatGPT GitHub app as read-only, while the reported attack involved write operations. This discrepancy suggests the vulnerability may stem from misconfigured permissions or an undocumented integration path.
Tripathy first reported related behavior on September 4, 2026, demonstrated secret theft on September 28, and received an "out of scope" response from OpenAI on October 14. As of October 15, the attack remained functional in retests, though OpenAI has not confirmed the vulnerability or issued a patch.
The most effective mitigation, per Tripathy, is restricting repository access to only what the AI agent requires. His tests showed that narrowing permissions to a single repository blocked cross-repository writes, reducing exposure. OpenAI confirms that access can be adjusted via GitHub app settings.
This incident highlights the risks of indirect prompt injection, where malicious instructions embedded in external content (e.g., repositories, documents) manipulate AI agents. Earlier research, such as AgentFlayer, demonstrated similar threats involving connected services like Google Drive. While unrelated to a previously patched OpenAI Codex command injection flaw, this case underscores the need for strict access controls in AI-integrated workflows.
Source: https://cybersecuritynews.com/chatgpt-github-connector-flaw/
GitHub TPRM report: https://www.rankiteo.com/company/github
OpenAI TPRM report: https://www.rankiteo.com/company/openai
"id": "gitope1792081517",
"linkid": "github, openai",
"type": "Vulnerability",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Users with ChatGPT GitHub '
'integration enabled (potential '
'exposure)',
'industry': 'Artificial Intelligence / Software',
'name': 'OpenAI (ChatGPT GitHub Integration)',
'type': 'Technology Provider'}],
'attack_vector': 'Indirect Prompt Injection via GitHub Repository',
'customer_advisories': 'Users with ChatGPT GitHub integration enabled should '
'review and restrict repository access to minimize '
'exposure.',
'data_breach': {'data_exfiltration': 'Yes (test secret exfiltrated to '
'external server)',
'file_types_exposed': 'GitHub Actions workflow files, '
'potential other repository files',
'personally_identifiable_information': 'No (only test secret '
'used in research)',
'sensitivity_of_data': 'High (secrets, potential private '
'repository data)',
'type_of_data_compromised': 'Secrets (e.g., AUDIT_CANARY), '
'GitHub Actions workflows, '
'repository metadata'},
'date_detected': '2026-09-04',
'date_publicly_disclosed': '2026-10-15',
'description': 'A newly disclosed vulnerability in ChatGPT’s GitHub '
'integration could allow attackers to steal secrets from '
'private repositories by exploiting manipulated instructions. '
'The flaw involves an AI agent with repository access being '
'tricked into executing unauthorized actions, such as '
'committing a GitHub Actions workflow to a private repository '
'without user knowledge or approval, leading to secret '
'exfiltration.',
'impact': {'brand_reputation_impact': 'Potential reputational damage to '
'OpenAI due to undisclosed '
'vulnerability',
'data_compromised': 'Test secret (AUDIT_CANARY), potential '
'unauthorized file commits, private repository '
'discovery',
'operational_impact': 'Unauthorized write operations to private '
'repositories, potential secret exfiltration',
'systems_affected': 'ChatGPT GitHub integration, private GitHub '
'repositories with enabled integration'},
'initial_access_broker': {'entry_point': 'Public GitHub repository with '
'embedded malicious instructions'},
'investigation_status': 'Ongoing (vulnerability remains unpatched as of '
'2026-10-15)',
'lessons_learned': 'Risks of indirect prompt injection in AI-integrated '
'workflows, importance of strict access controls for AI '
'agents, and the need for clear documentation of '
'integration permissions.',
'motivation': 'Security Research / Vulnerability Demonstration',
'post_incident_analysis': {'corrective_actions': 'Restrict repository access, '
'enhance permission '
'documentation, and '
'implement stricter '
'validation for AI agent '
'actions.',
'root_causes': 'Misconfigured permissions or '
'undocumented integration path in '
'ChatGPT’s GitHub app, lack of '
'strict access controls for AI '
'agents, and indirect prompt '
'injection vulnerabilities.'},
'recommendations': 'Restrict repository access for AI agents to only '
'necessary repositories, monitor for unauthorized write '
'operations, and review integration permissions regularly.',
'references': [{'source': 'Security Research by Sunil Tripathy'}],
'response': {'containment_measures': 'Restricting repository access to only '
'what the AI agent requires'},
'stakeholder_advisories': 'OpenAI has not confirmed the vulnerability or '
'issued a patch. Users are advised to restrict '
'repository access for the ChatGPT GitHub '
'integration.',
'threat_actor': 'Security Researcher (Sunil Tripathy)',
'title': 'Critical ChatGPT GitHub Integration Flaw Enables Secret Theft via '
'Prompt Injection',
'type': 'Vulnerability Exploitation',
'vulnerability_exploited': 'Misconfigured permissions or undocumented '
'integration path in ChatGPT’s GitHub app'}