A newly disclosed security test shows how malicious instructions placed in a public GitHub repository could potentially turn an AI-assisted code review into an attack on private source code. The researcher behind the finding says the chain used indirect prompt injection to make an agent cross repository boundaries, create a workflow and send a test secret to an outside server.

The report, published October 15, assigns the scenario a CVSS 4.0 score of 9.3. That score is the researcher’s assessment rather than an official vendor rating. Testing reportedly took place only with accounts and infrastructure controlled by the researcher, using a harmless canary value instead of real customer data.

How the reported attack worked

The test involved an attacker-controlled public repository containing concealed instructions and a separate victim account that had connected GitHub to an AI assistant. When asked to review the public project, the system allegedly treated content in the repository as directions rather than untrusted data.

According to the disclosure, those instructions caused the agent to discover another repository available to the victim and commit a GitHub Actions workflow there. The workflow then ran with access to a test secret and transmitted the canary value to an external endpoint. The user had not explicitly named the private repository or approved that write operation, the researcher said.

This pattern is known as indirect prompt injection. Instead of directly asking an AI system to perform a prohibited action, an attacker embeds commands in material the system is expected to summarize, inspect or process. If the model cannot reliably distinguish content from authority, those instructions may influence later tool calls.

Permissions determine the real impact

An important detail remains unresolved in the public account: OpenAI’s documentation describes the standard ChatGPT GitHub connector as read-only, while code changes and pushes are associated with other development workflows such as Codex. The reported ability to commit files means the precise product configuration, permission grants and execution path are essential to understanding exposure.

Even so, the broader lesson applies to any AI agent that combines access to untrusted repositories with write permissions elsewhere. A model does not need to reveal a secret directly if it can create an automated workflow that reads the secret and sends it out. This converts a prompt-handling weakness into a conventional supply-chain and credential-theft problem.

Why simple refusals may not be enough

The researcher reported that bluntly worded malicious instructions were rejected, while commands framed as deployment requirements succeeded. An innocent-looking workflow reference allegedly pointed to a custom action holding the exfiltration logic. Other claimed results included discovering private repository names, committing attacker-selected files and recovering instructions from Git history.

These findings have not been independently verified, and the exact affected integration should be confirmed before drawing conclusions about all ChatGPT or GitHub users. They nevertheless illustrate why content filtering alone is an incomplete defense. Attackers can divide an objective across files, encode intent in normal development language and rely on trusted automation to perform the sensitive step.

Reducing connector and agent risk

• Grant AI integrations access only to the repositories required for a specific task.
• Separate read-only analysis from tools capable of committing code or running workflows.
• Require human approval before cross-repository writes or workflow-file changes.
• Restrict GitHub Actions tokens and secrets to the minimum necessary scope.
• Alert on unexpected workflow creation, secret access and outbound network traffic.

Organizations should also treat repository text, issues, pull requests and documentation as attacker-controlled input whenever public contributors can influence them. Tool calls should be authorized by deterministic policy rather than by the model’s interpretation of instructions found in content.

The disclosure is best understood as a warning about privilege composition: a reading assistant may appear low risk, but connecting it to broad source-code access and automated execution can produce a powerful attack path. Clear product scoping and confirmation from the relevant vendors will be needed to establish exactly which configurations require remediation.

Source: Cyber Security News.