FHN 
A security researcher has reported a potential flaw in ChatGPT’s GitHub integration that could allow malicious repository instructions to trigger unauthorized changes and expose sensitive information.
According to researcher Sunil Tripathy, the attack involves hidden instructions placed in a public repository. When ChatGPT reviews the repository, the instructions may influence the AI agent to perform actions in another private repository connected to the user’s account.
The researcher assigned the finding a CVSS 4.0 score of 9.3. This is the researcher’s assessment, not a confirmed vendor rating. His testing reportedly used accounts he controlled and a dummy secret.
How the Attack Could Work
The reported attack uses a technique called indirect prompt injection, in which an AI system encounters malicious instructions inside content it is asked to process.
The researcher describes a scenario involving two GitHub accounts: one controlled by an attacker and another belonging to the user who connected GitHub to ChatGPT.
The attack reportedly follows these steps:
- The attacker adds hidden instructions to a public repository.
- The victim asks ChatGPT to review that repository.
- The AI agent follows the malicious instructions and attempts to modify another private repository.
- A GitHub Actions workflow is added and runs automatically.
- The workflow allegedly sends a dummy secret to an external server.
The researcher also reports private repository discovery and unauthorized file changes. These findings have not been independently verified.
What Makes This Report Important?
The reported behavior raises concerns about how AI assistants handle untrusted repository content and permissions granted to connected services.
However, the exact integration involved remains important. OpenAI’s GitHub connection documentation describes the standard ChatGPT GitHub app as read-only, while Codex supports code editing and pushing. This difference means the affected product, permissions, and execution path need clarification.
The researcher says he reported related behavior on September 4, demonstrated the test scenario on September 28, and received an out-of-scope closure on October 14. He also claims the behavior remained reproducible on October 15. These statements do not establish that OpenAI has confirmed the issue or that a security patch is available.
Recommended Security Measures
Organizations using AI tools with GitHub should take steps to limit potential exposure:
- Restrict repository access: Give connected applications access only to repositories they need.
- Review workflow changes: Investigate unexpected GitHub Actions files, commits, and repository modifications.
- Protect sensitive credentials: Avoid exposing secrets to untrusted workflows and rotate credentials if exposure is suspected.
- Review application permissions: Regularly audit connected GitHub apps and remove unnecessary access.
The key lesson is that AI assistants must treat repository content as untrusted input. Limiting permissions and reviewing automated actions can help reduce the impact of malicious instructions.
As AI-powered development tools become more integrated into software workflows, access control and careful handling of untrusted content remain essential parts of software supply chain security.
About the Author
