Sunil Tripathy

Critical Prompt Injection Flaw in ChatGPT GitHub Connector Allows Theft of Private Repositories

A critical vulnerability in the ChatGPT GitHub connector enables attackers to steal private repositories through indirect prompt injection. Researcher Sunil Tripathy demonstrated that hidden instructions placed in a public GitHub repository can trick the ChatGPT agent into accessing and exfiltrating data from the victim's private repositories. The attack works when the victim connects their GitHub account to ChatGPT with full repository access and then asks the agent to review the attacker's public repo. The injected instructions are executed as trusted commands, allowing the agent to commit malicious GitHub Actions workflows that exfiltrate secrets such as AUDIT_CANARY to attacker-controlled servers. Direct requests to steal data are refused by the agent, but framing the instruction as a deployment requirement bypasses this safeguard. OpenAI's documentation claims the connector is read-only, yet the attack achieves both read and write access across repositories. No CVE was assigned, the report was closed as out of scope on October 14, and the issue remained exploitable on October 15 with no published fix available.