# ChatGPT GitHub Connector Indirect Prompt Injection Allows Private Repository Secret Exfiltration via Unapproved GitHub Actions Workflow Commits

> An indirect prompt injection flaw in the ChatGPT GitHub connector lets a hidden-instruction payload in an attacker-controlled public repository cause ChatGPT's agent to commit a GitHub Actions workflow to a victim's private repository without user approval. The workflow runs automatically and sends repository secrets to an external server. The researcher reports it was still exploitable on 2026-10-15, one day after OpenAI closed the report as out of scope.

- **Published:** 2026-10-15T16:16:05Z
- **Last reviewed:** 2026-10-15T16:16:05Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3639
- **ID:** TL-2026-3639
- **Severity:** CRITICAL (CVSS 9.3)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Independent researcher Sunil Tripathy disclosed on 2026-10-15 an indirect prompt injection weakness in the ChatGPT GitHub connector. The attacker only needs to publish one public repository containing a hidden payload. When a victim who has connected GitHub to ChatGPT with the default 'All repositories' grant asks ChatGPT to review that repository, the agent treats the repository content as trusted instructions rather than data. No further click or confirmation is required beyond the victim's initial review request.

The researcher documents a guardrail bypass: a direct request to review a specific repository was refused, but a business-context framing ('deployment audit' with workspace remediation, instructions framed as deployment requirements) was followed. The payload's data-theft logic is not placed in the committed workflow itself. The workflow contains an innocent-looking reference, a 'uses:' step pointing to a separate custom action that holds the exfiltration code. This keeps the malicious logic out of reach of surface-level guardrail evaluation.

Once the agent follows the instructions it writes a GitHub Actions workflow under .github/workflows/ in a different, private repository of the victim that the user never mentioned. GitHub Actions executes the committed workflow automatically, resolves secrets.AUDIT_CANARY (a dummy secret used for the test) and transmits it to an external webhook. The researcher reports three independent webhook receipts and an end-to-end video demonstration. All testing was on researcher-owned accounts using dummy credentials, and no exploit code was published.

The researcher lists seven observable impacts from a single malicious prompt: (1) cross-repository workflow commit; (2) automated CI execution without user intervention; (3) secret exfiltration; (4) account reconnaissance, with the agent enumerating all repositories including private ones and writing an inventory document; (5) content transplant, with attacker-authored material committed to victim repositories; (6) persistence through git history, with workflows reconstructed from revision history even after removal; and (7) session extraction, with conversation transcripts committed to accessible locations. Key weaknesses are the broad default permission grant, no human confirmation before writing .github/workflows/ files, and no separation between instructions and untrusted repository content. OpenAI documentation describes the standard connector as read-only, yet the reported commits imply write capability, a discrepancy the source article flags.

Disclosure timeline per the researcher: initial report 2026-09-04; full attack chain demonstrated with webhook evidence 2026-09-28; triage clarification 2026-10-05; report moved between programs and retargeted to 'Other' on 2026-10-07; closed as out of scope 2026-10-14; public disclosure 2026-10-15. The researcher states the closure used criteria absent from the published program brief, which lists this attack type as in scope for the 'Agentic Tools Including MCP' program. No vendor patch or CVE exists and the vendor has not confirmed the severity. The CVSS 4.0 score of 9.3 is researcher-assigned. No in-the-wild exploitation has been reported. The source article mentions that the Codex connector may be related, but this is not established. Evidence rests on the researcher's writeup and a single news article.

## MITRE ATT&CK

- T1608 Stage Capabilities
- AML.T0051 LLM Prompt Injection
- AML.T0051.001 LLM Prompt Injection: Indirect
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1098 Account Manipulation
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1199 Trusted Relationship
- T1552 Unsecured Credentials
- T1213.003 Data from Information Repositories: Code Repositories
- T1567 Exfiltration Over Web Service
- T1565.001 Data Manipulation: Stored Data Manipulation

## Sources

- [Critical ChatGPT GitHub Connector Flaw Could Allow Attackers to Steal Private Repository Secrets](https://cybersecuritynews.com/chatgpt-github-connector-flaw/)
- [ChatGPT GitHub Connector Vulnerability (researcher writeup, Sunil Tripathy)](https://sunilawesome.in/chatgpt-github-connector-vulnerability)
- [MITRE ATLAS AML.T0051 LLM Prompt Injection](https://atlas.mitre.org/techniques/AML.T0051)
- [OpenAI Help: Connecting GitHub to ChatGPT](https://help.openai.com/en/articles/11145903-connecting-github-to-chatgpt-deep-research)
- [BeyondTrust Phantom Labs: OpenAI Codex command injection enabling GitHub token theft (related ChatGPT Codex Connector issue)](https://beyondtrust.com/blog/entry/openai-codex-command-injection-vulnerability-github-token)
- [CSA Research Note: Prompt Injection in AI-Powered GitHub Actions](https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-github-actions-security-20260503-csa-st/)
- [CWE-862: Missing Authorization](https://cwe.mitre.org/data/definitions/862.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3639