A vulnerability in ChatGPT's GitHub integration has been identified, which could potentially allow attackers to access private repository secrets. Researcher Sunil Tripathy disclosed on October 15, 2026, that manipulated repository instructions could lead an AI agent to modify private repositories and trigger GitHub Actions workflows. In this scenario, an attacker controlled a public repository containing hidden instructions, while the victim's account was connected to ChatGPT with access to multiple repositories.
Tripathy assigned the flaw a CVSS 4.0 score of 9.3, indicating a high severity level, although this rating is his own assessment and not an official vendor classification. The tests were conducted using researcher-owned accounts and dummy secrets, ensuring no real customer data was compromised. The vulnerability allows a request to review a public repository to be followed as a trusted command, resulting in the execution of a GitHub Actions workflow in a private repository. This workflow could then send a test secret, labeled AUDIT_CANARY, to an external server without the victim's knowledge or approval.
This attack exemplifies an indirect prompt injection, where hostile instructions are embedded in documents read by the assistant. Previous research has highlighted similar risks with malicious documents and connected Google Drive data. Tripathy noted that instructions framed as deployment requirements were successful in triggering the attack, while direct wording was refused by the system.
The findings also revealed additional outcomes such as the discovery of private repositories and unauthorized file commits. However, these results remain unverified by external sources. A significant point of contention is the difference between OpenAI's GitHub app documentation, which describes the app as read-only, and the reported ability to commit code, highlighting a need to confirm the exact permissions and integration paths involved.
Tripathy initially reported the issue on September 4 and demonstrated secret theft on September 28. Despite receiving an "out of scope" closure on October 14, the attack was still effective when retested the following day. Until a confirmed patch is released, defenders are advised to limit repository access to essential tasks and review unexpected workflow commits. OpenAI has confirmed that repository access can be adjusted through GitHub app settings. Additionally, Tripathy's control tests showed that restricting permissions to a single repository could effectively block cross-repository writes.
