RESEARCHER REPORT — OCT 15, 2026 — ALLEGED, NOT CONFIRMED

ChatGPT's GitHub connector allegedly leaks repo secrets — lock yours down now — a cybersecurity news warning

A GitHub connector is an integration letting ChatGPT read your repositories. This cybersecurity news warning covers the alleged repo-secret leak — what is alleged vs. real — and a 60-second hardening check.

Reviewed October 18, 2026 — Ingenious AI security check.

Could your GitHub connector become a cybersecurity news story?

Allegedly, yes — researchers reported the connector could expose repository contents and secrets beyond what users intended, and HackerOne saw a 540 percent rise in valid prompt-injection reports. The exact scope remains contested, which is why this page separates allegation from fact. The hardening check below is useful regardless: audit connected apps, revoke stale access, rotate exposed secrets.

What is the ChatGPT GitHub connector?

An integration that lets ChatGPT read and work with your GitHub repositories — convenient, and a new path for repo secrets to leak if misconfigured.

A researcher report published October 15, 2026 alleges that ChatGPT's GitHub connector could let attackers steal repository secrets through indirect prompt injection — triggered, the report claims, when a user asks ChatGPT to review an attacker-controlled public repo, with unauthorized writes and secret exfiltration allegedly happening without additional user confirmation. The researcher calculated CVSS 4.0 score 9.3 (Critical). Read the label carefully: alleged, not independently verified. But the pattern it describes — an AI holding your credentials while reading untrusted content — is real, and this 60-second checklist closes it either way. Free, no signup.

The 60-second connector-hardening check — tick what applies

An AI connector with broad GitHub access — ChatGPT, Copilot, or any AI tool authorized on your GitHub org with write/admin scopes. Broad scopes mean one bad instruction can do real damage. You've asked AI to review untrusted third-party repos — public repos you didn't write, dependency code, PRs from strangers — in a session connected to your secrets or your GitHub account. Stale connectors you no longer use — old OAuth authorizations sitting in your GitHub settings with repo access. Every unused connector is an unmonitored door. Secrets never rotated after external code reviews — tokens, deploy keys, or CI secrets that were live while AI reviewed code you don't fully trust. No audit-log review habit — you don't regularly check who (or what) accessed your repos, or your org has no alerting on unusual secret access.

Audit and revoke stale access today

# List everything authorized on your GitHub account/org
# Settings → Applications → Authorized OAuth Apps (do this in the UI)
# Then revoke anything AI-related you don't actively use.
# For orgs, also check: Settings → Third-party Access

gh auth refresh -h github.com -s read:org   # least-privilege re-auth
# Rotate any secret that was live during an untrusted review:
gh secret list                              # inventory first
gh secret delete DEPLOY_TOKEN && gh secret set DEPLOY_TOKEN  # then rotate

Least privilege is the whole game: read-only scopes for review work; write scopes only where the AI genuinely needs to push — and never both at once on untrusted input.
Separate your sessions: one connected session for your own trusted repos; a fully disconnected session (no connectors, no secrets) for reviewing anything you didn't write.

What's alleged vs. what's real — stay honest

Alleged (unconfirmed): the specific ChatGPT GitHub connector flaw — the 9.3 CVSS, the secret-exfiltration chain, the no-confirmation writes. A single researcher report; not independently verified. We describe the claim, not the exploit, and we won't publish attack details.
Real: indirect prompt injection as an attack class — MITRE enshrined it as T1698 in ATT&CK v20 (Oct 2026); HackerOne saw a 540% rise in valid prompt-injection reports; 141 CVEs mention prompt injection, 87 of them in 2026 alone.
Real: the Copilot CLI "Cryptographic Context Injection" finding (Oct 2026) — an attacker-controlled webpage allegedly guiding a coding agent to read local files and exfiltrate them. Same pattern, different product: AI + credentials + untrusted content = exposure.
Bottom line: whether or not this one report pans out, every AI connector holding repo credentials deserves the checklist above. Harden the pattern, not just the headline.

Writing about this? Embed the checker

Drop a live connector-hardening checker into your blog, docs, or forum post — three lines of HTML.

Get the embed code

Test your chatbot against indirect prompt injection → ChatBreaker

This page checked your connector hygiene. ChatBreaker red-teams AI chatbots against 40+ attack patterns — including the indirect prompt injection class behind this alleged flaw.

FROM INGENIOUS AI

ChatBreaker finds the prompt-injection holes before attackers do.

All 11 platforms: DisclosureGuard · ModelMinder · TermsWatch · Vibe-Code Audit · Rogue-Agent Defense · BreachHunter · ChatBreaker · Agent Flight Recorder · Agent Auth Gateway · DomainGuard · ContentCraft AI

Our platforms are being upgraded and return November 1 — get early access now:

Get early access on WhatsApp →

Frequently asked questions

FAQ

What is the alleged ChatGPT GitHub connector flaw?

A researcher report published October 15, 2026 alleges that ChatGPT's GitHub connector could allow attackers to steal repository secrets through indirect prompt injection. The researcher calculated a CVSS 4.0 score of 9.3 (Critical).

How would the alleged attack work?

According to the researcher's public description, the alleged attack begins when a user asks ChatGPT to review an attacker-controlled public repository. Malicious instructions allegedly embedded in that repository could trigger the AI into unauthorized writes and secret exfiltration without additional user confirmation.

Is the ChatGPT GitHub connector vulnerability confirmed?

No. As of this writing it remains an alleged, researcher-reported finding.