Researchers disclose a ChatGPT GitHub connector vulnerability; indirect prompt injection can write workflows across repositories and exfiltrate secrets

Independent security researcher Sunil Tripathy publicly disclosed a vulnerability in the ChatGPT GitHub connector: an attacker publishes a public repository containing hidden instructions, and when a victim asks ChatGPT to review it, the agent uses the victim's own credentials to commit a GitHub Actions workflow to an unmentioned private repository, which upon triggering exfiltrates repository secrets to the attacker's server. The author states the attack exploits the connector's default All repositories authorization; the attacker does not need to touch the victim's account, and the user does not need to click or confirm anything. Restricting the connector to a single repository makes the same attack ineffective. The author states that wrapping malicious actions in a business context can bypass guardrails, because the guardrails only check surface-level steps. The author's CVSS 4.0 score is 9.3, classified under OWASP LLM01 prompt injection and LLM06 excessive agency.