ChatGPT GitHub Connector Flaw Could Expose Private Repository Secrets
Source
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More
The Hacker News
Via The Hacker News
What happened
Security researchers disclosed that ChatGPT's GitHub Connector could be manipulated through indirect prompt injection. The GitHub Connector lets the AI assistant read and interact with code repositories. An attacker controlling a public GitHub repository could embed hidden instructions in that repository's content. When a user asked ChatGPT to work with that repository, the assistant could silently follow those hidden instructions. It could then write a GitHub Actions workflow file into a different private repository the user had connected. GitHub Actions workflow files control automated software build and deployment tasks. That workflow file could then cause the private repository to expose secrets such as access credentials and service keys stored in its configuration. Reporting on the flaw appeared in ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More. The core failure mirrors the pattern described in coverage of indirect prompt injection via tool outputs. The AI acted on content it read rather than on instructions from its authorized user.
Why it matters
- ·Any enterprise using ChatGPT's GitHub Connector with write access enabled faces a concrete risk that untrusted third-party code repositories could silently direct the AI to modify internal repositories. This could expose credentials used by software pipelines, triggering breach notification obligations under the General Data Protection Regulation (GDPR) and equivalent rules in other jurisdictions.
- ·The flaw exposes a structural gap in how AI coding assistants are governed. Most organizations have not separated read permissions from write permissions for AI tools. Most also lack a mandatory human approval step before the AI commits changes to any repository. Without those controls, a connected AI assistant is effectively a privileged insider that any public repository can instruct.
- ·This incident adds to a growing pattern of AI developer tool compromises, including the GitHub Copilot CLI credential leak and AI coding agent screenshot leak. This suggests that AI tools with source code access are a systematic attack surface that vendor due diligence programs have not yet caught up with.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- Regulators, litigants, and attackers are all moving faster than most organizations' AI governance frameworks, shifting leverage away from deployers and toward those who can prove control, accountability, and honest disclosure.21 Oct
- Three separate incidents this week reveal that AI vendors cannot be trusted to self-police, and that harm from deployed agents can run unchecked for months before anyone inside the organization notices.15 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Ask your engineering team to confirm whether ChatGPT or any other AI assistant has write access to any internal code repository, and suspend write access for any tool that lacks a human approval step before committing changes.
- ☐Review the permission scope granted to every AI coding assistant connected to your source code repositories and enforce read-only access as the default, with write access granted only for specific, documented use cases.
- ☐Ask your security team whether any AI tool connected to internal repositories can also read public or third-party repositories in the same session, and whether controls exist to prevent instructions from those external sources from influencing the AI's actions on internal systems.
- ☐Update your vendor due diligence checklist for AI coding tools to require that the vendor discloses how it handles indirect instructions embedded in third-party content, and what confirmation steps occur before the AI takes any write action.
- ☐Check whether your incident response plan covers the scenario where an AI assistant modifies a repository or exposes stored credentials, and assign a named owner for that response procedure.
What to watch next
Watch for OpenAI to release a formal advisory or patch notice. It should describe whether the GitHub Connector's permission model has been updated and whether write actions now require explicit user confirmation. Compliance teams should also monitor whether this class of flaw attracts enforcement attention from data protection regulators. This is particularly relevant in the EU. Both the EU AI Act (Regulation (EU) 2024/1689) and GDPR create obligations when AI systems cause unauthorized data exposure. Broader legislative proposals targeting agentic AI authorization controls are likely to reference incidents of this type as evidence that voluntary controls are insufficient. One such proposal is the Five Eyes Guidance on the Careful Adoption of Agentic AI Services.