A security researcher, Sunil Tripathy, published a disclosure on October 15 describing a flaw in ChatGPT's GitHub integration: hidden instructions in a public repository allegedly led the agent, during a routine review request, to modify a different private repository and trigger a GitHub Actions workflow.

In the researcher's test, which used accounts he controlled and a dummy secret, the workflow sent the test value to an external server. He assigns the finding a CVSS 4.0 score of 9.3; that rating is his own assessment, not a vendor classification.

Treat this as an unverified report for now. The write-ups all trace back to the single disclosure, the findings have not been independently verified, and the coverage includes no confirmation from OpenAI. The pattern it describes is indirect prompt injection: hostile instructions arriving inside material the assistant is asked to read.