Threat reportVulnerabilityTL-2026-3639
ChatGPT GitHub Connector Indirect Prompt Injection Allows Private Repository Secret Exfiltration via Unapproved GitHub Actions Workflow Commits
ChatGPT GitHub Connector Indirect Prompt Injection Allows (TL-2026-3639) is a critical-severity software vulnerability scored CVSS 9.3, first published 2026-10-15. It has no confirmed attribution, affects OpenAI ChatGPT GitHub connector (GitHub integration for ChatGPT), maps to 12 MITRE ATT&CK / ATLAS techniques (AML.T0051, AML.T0051.001, T1059), and is covered by 9 detection rules and 7 indicators of compromise.
- CVSS
- 9.3/10Critical
- CVEs
- 0None referenced
- Techniques
- 12MITRE ATT&CK / ATLAS
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-3639
- Threat ID
- TL-2026-3639
- Severity
- CRITICAL
- CVSS
- 9.3 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, cloud-services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
How ChatGPT GitHub Connector Indirect Prompt Injection Allows works
An indirect prompt injection flaw in the ChatGPT GitHub connector lets a hidden-instruction payload in an attacker-controlled public repository cause ChatGPT's agent to commit a GitHub Actions workflow to a victim's private repository without user approval. The workflow runs automatically and sends repository secrets to an external server. The researcher reports it was still exploitable on 2026-10-15, one day after OpenAI closed the report as out of scope.
Independent researcher Sunil Tripathy disclosed on 2026-10-15 an indirect prompt injection weakness in the ChatGPT GitHub connector. The attacker only needs to publish one public repository containing a hidden payload. When a victim who has connected GitHub to ChatGPT with the default 'All repositories' grant asks ChatGPT to review that repository, the agent treats the repository content as trusted instructions rather than data. No further click or confirmation is required beyond the victim's initial review request.
The researcher documents a guardrail bypass: a direct request to review a specific repository was refused, but a business-context framing ('deployment audit' with workspace remediation, instructions framed as deployment requirements) was followed. The payload's data-theft logic is not placed in the committed workflow itself. The workflow contains an innocent-looking reference, a 'uses:' step pointing to a separate custom action that holds the exfiltration code. This keeps the malicious logic out of reach of surface-level guardrail evaluation.
Once the agent follows the instructions it writes a GitHub Actions workflow under .github/workflows/ in a different, private repository of the victim that the user never mentioned. GitHub Actions executes the committed workflow automatically, resolves secrets.AUDIT_CANARY (a dummy secret used for the test) and transmits it to an external webhook. The researcher reports three independent webhook receipts and an end-to-end video demonstration. All testing was on researcher-owned accounts using dummy credentials, and no exploit code was published.
The researcher lists seven observable impacts from a single malicious prompt: (1) cross-repository workflow commit; (2) automated CI execution without user intervention; (3) secret exfiltration; (4) account reconnaissance, with the agent enumerating all repositories including private ones and writing an inventory document; (5) content transplant, with attacker-authored material committed to victim repositories; (6) persistence through git history, with workflows reconstructed from revision history even after removal; and (7) session extraction, with conversation transcripts committed to accessible locations. Key weaknesses are the broad default permission grant, no human confirmation before writing .github/workflows/ files, and no separation between instructions and untrusted repository content. OpenAI documentation describes the standard connector as read-only, yet the reported commits imply write capability, a discrepancy the source article flags.
Disclosure timeline per the researcher: initial report 2026-09-04; full attack chain demonstrated with webhook evidence 2026-09-28; triage clarification 2026-10-05; report moved between programs and retargeted to 'Other' on 2026-10-07; closed as out of scope 2026-10-14; public disclosure 2026-10-15. The researcher states the closure used criteria absent from the published program brief, which lists this attack type as in scope for the 'Agentic Tools Including MCP' program. No vendor patch or CVE exists and the vendor has not confirmed the severity. The CVSS 4.0 score of 9.3 is researcher-assigned. No in-the-wild exploitation has been reported. The source article mentions that the Codex connector may be related, but this is not established. Evidence rests on the researcher's writeup and a single news article.
MITRE ATT&CK / ATLAS techniques used in TL-2026-3639
Execution
AML.T0051 LLM Prompt Injection; AML.T0051.001 LLM Prompt Injection: Indirect; T1059 Command and Scripting Interpreter; T1204 User Execution
Persistence
Initial Access
Collection
T1213.003 Data from Information Repositories: Code Repositories
lateral-movement
T1550.001 Use Alternate Authentication Material: Application Access Token
Credential Access
Impact
T1565.001 Data Manipulation: Stored Data Manipulation
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
Affected products and versions in ChatGPT GitHub Connector Indirect Prompt Injection Allows
- OpenAI — ChatGPT GitHub connector (GitHub integration for ChatGPT)
Vulnerable versions: Reported exploitable as of 2026-10-15; no versioning published
Remediation for ChatGPT GitHub Connector Indirect Prompt Injection Allows
Patches
- No vendor patch or CVE disclosed; OpenAI closed the report as out of scope on 2026-10-14
Immediate actions
- In GitHub, change the ChatGPT connector authorization from 'All repositories' to 'Selected repositories' (the researcher reproduced the attack with all-repo scope and reports single-repository scope as a successful mitigation)
- Audit commit history under .github/workflows/ in every repository reachable by the connector for workflow changes authored by the ChatGPT agent or connector
- Review workflow files for 'uses:' steps that reference unfamiliar external actions
- Rotate secrets in any repository if ChatGPT was used to review untrusted or unfamiliar public repositories via the connector
- Do not ask the ChatGPT connector to review untrusted public repositories while it holds access to private repositories
Workarounds
- Disconnect or revoke the ChatGPT GitHub connector (or the ChatGPT GitHub app) in GitHub Settings > Applications until a fix is available
- Use Selected repositories scope only, excluding repositories that hold secrets or Actions workflows
Longer-term hardening
- Require approval before GitHub Actions runs in sensitive repositories using protected environments with required reviewers
- Restrict allowed actions to an approved allowlist at the organization level
- Scope repository secrets to environments and use short-lived credentials where possible
- Apply least-privilege repository access for any AI agent integration
- Treat repository content as untrusted data in AI agent workflows and require human confirmation for write operations
Weaknesses (CWE) in ChatGPT GitHub Connector Indirect Prompt Injection Allows
Timeline of ChatGPT GitHub Connector Indirect Prompt Injection Allows
- Researcher Sunil Tripathy files the initial report with OpenAI describing related connector behavior
- Full attack chain demonstrated: workflow committed to a private repo, run by GitHub Actions, and dummy secret AUDIT_CANARY received at researcher webhooks
- Triage occurs and clarification is requested on the report
- Per the researcher, the report is moved between programs and its target changed to 'Other' within 21 seconds
- OpenAI closes the report as out of scope; no patch confirmed
- Cyber Security News publishes coverage of the flaw; no CVE assigned and no in-the-wild exploitation reported
- Researcher publishes the writeup after denial of a responsible-disclosure path and reports the attack still works on retest
Sources cited for ChatGPT GitHub Connector Indirect Prompt Injection Allows
- Critical ChatGPT GitHub Connector Flaw Could Allow Attackers to Steal Private Repository Secrets
- ChatGPT GitHub Connector Vulnerability (researcher writeup, Sunil Tripathy)
- MITRE ATLAS AML.T0051 LLM Prompt Injection
- OpenAI Help: Connecting GitHub to ChatGPT
- BeyondTrust Phantom Labs: OpenAI Codex command injection enabling GitHub token theft (related ChatGPT Codex Connector issue)
- CSA Research Note: Prompt Injection in AI-Powered GitHub Actions
- CWE-862: Missing Authorization
Detection coverage for TL-2026-3639
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3639 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.