Hidden Repo Instructions Turn ChatGPT GitHub Connector Into Secret Thief

Key Takeaways

• A researcher showed hidden instructions in a public repository could steer ChatGPT's GitHub connector.
• ChatGPT committed a GitHub Actions workflow to a separate private repository the victim had connected.
• The workflow ran automatically and sent a test secret to an external server.
• OpenAI closed the report as out of scope, and the attack still worked on October 15.
• This is a proof of concept with no reported exploitation in the wild.

A Code Review Request Became a Secret Leak

A researcher demonstrated that asking ChatGPT to review a malicious public repository could cause it to write an exfiltration workflow into a victim's private repository. As Cyber Security News reported, the attack required no approval for the write, and OpenAI declined to treat it as a vulnerability.

What We Know

Researcher Sunil Tripathy first reported related behavior to OpenAI on September 4, 2026, demonstrated secret theft on September 28, and received an out of scope closure on October 14. He published on October 15 after confirming the attack still worked.

In the demonstration, a public repository contained hidden instructions framed as deployment requirements. When the victim asked ChatGPT to review it, the agent committed a GitHub Actions workflow to a different, private repository the user had connected. The workflow called a custom action that sent a dummy secret named AUDIT_CANARY to an external server. The researcher rated it CVSS 4.0 9.3, his own assessment. OpenAI's GitHub app setup guidance shows admins can grant ChatGPT write permissions for contents and workflows.

What Could Happen

This is indirect prompt injection with real write access. ChatGPT treated text inside an untrusted repository as instructions, then used its GitHub permissions to act on a different repository the user never mentioned. Direct requests to exfiltrate were refused, but the same goal phrased as routine deployment work succeeded.

GitHub Actions supplied the payload delivery. Once the workflow was committed, it ran automatically with access to repository secrets. An attacker could use the same chain to steal cloud keys, publish tokens, or plant persistent code, and each step would appear as a legitimate commit by the connected app.

Why It Matters

Enterprises increasingly connect AI assistants to source control with write access. This case shows a single untrusted repository can become a remote control for every repository the assistant can reach. Secrets stored in CI/CD are often the keys to production.

The vendor's out of scope decision matters as much as the bug. If the provider considers this expected behavior, customers must assume the risk themselves through permission scoping and monitoring. Organizations should grant write access only where required and review commits made by AI apps.

PointGuard AI Perspective

Prompt injection becomes dangerous when an agent can act on what it reads. PointGuard AI Intelligent Guardrails inspect content flowing into AI assistants, detect hidden or disguised instructions in repositories and documents, and can block actions that do not match the user's request.

PointGuard AI Agent Mission Control applies mission-based authorization, so an assistant asked to review one repository cannot write workflows into another. Our blog Prompt Injection vs. Indirect Prompt Injection explains why the hidden variety is harder to catch. Safe use of connected AI assistants depends on enforcing intent, not trusting the model to refuse.

Incident Scorecard Details

Total AISSI Score: 5.6/10

Criticality: 7, Private repositories and CI/CD secrets can unlock production systems. AISSI weighting: 25%

Propagation: 6, One poisoned repository can reach every repository the connector is allowed to write to. AISSI weighting: 20%

Exploitability: 4, A working proof of concept was demonstrated, with no exploitation reported. AISSI weighting: 15%

Supply Chain: 7, Risk sits in a hosted third-party AI service and its GitHub integration. AISSI weighting: 15%

Business Impact: 4, Only test secrets were taken, though the vendor has not changed the behavior. AISSI weighting: 25%

Sources

Third-Party Sources

• Cyber Security News: ChatGPT GitHub Connector Flaw Exposes Private Repository Secrets
• OpenAI Help Center: Set up the GitHub Enterprise app template in ChatGPT

PointGuard AI Sources

• PointGuard AI Intelligent Guardrails
• PointGuard AI Agent Mission Control
• PointGuard AI Blog: Prompt Injection vs. Indirect Prompt Injection