Update, 26 October: the researcher’s write-up page now shows an embargo notice instead of the article. The details below are from that write-up as published on 15 October; The Hacker News summarised the same attack on 22 October. The CVSS score and the single-repository test come from the write-up alone.
In cricket’s DRS, a machine’s call goes to a human before it counts. Slow, a little annoying, and the whole point.
This week’s story is a machine’s call that, by one researcher’s account, never went to anyone.
the tell#
On 15 October, independent researcher Sunil Tripathy published an attack on ChatGPT’s GitHub connector. He scored it CVSS 4.0 9.3, critical. That score is his own, and no CVE is listed.
His account: an attacker owns a public repository with hidden instructions in it. The victim has the connector authorised with the default All-repositories grant, and asks only: “Do the deployment review for this repository.” The agent reads the attacker’s repository, treats its content as instructions, and commits a GitHub Actions workflow into a different, private repository the user never mentioned. GitHub runs it. The workflow reads a dummy secret and sends it to the attacker’s webhook. He reports three receipts from a GitHub runner IP.
Two details stand out. A direct request naming the repository was refused, but the same task phrased as a business problem (“deployment audit… is failing”) went through. And with the connector limited to a single repository, the same attack failed.
What the source leaves out: OpenAI’s side. By his account the report was closed on 14 October as “Out of scope” and described as “working as designed”. I did not find a public statement from OpenAI. His evidence (video, receipts) is “available on request”, not published, and the tests used his own accounts and a dummy secret.
My read: the model did not break a rule. It followed the wrong reader’s instruction with the right user’s keys. The control that worked was the size of the grant, not the wording of a prompt.
in the queue#
The log to look at is the commit history and workflow run list of your private repositories.
What it would look like: a new or changed file under .github/workflows/ in a repository nobody was working on, followed by a run on that push. The post does not say whether the commit shows as you or as an app, so I would check that in a test organisation first.
The gap: per the post, the secret left from a GitHub runner, and the exfiltration logic sat one uses: step away. My inference is that your network telemetry would not see it, and the run log may not show it either.
What would fool a detection: your engineers editing workflows for real, and bot commits. A rule keyed on the author name also misses an agent that commits as you.
Before trusting a rule for this, especially an AI-written one: replay 90 days of workflow-file commits and count what it fires on in a normal week. Then, in a throwaway repository with a dummy secret, run the attack on purpose and see if anything alerts.
hype meter#
3 out of 5 hype (1 = mostly signal, 5 = mostly hype) · Anthropic’s warning that small AI models could form self-propagating IoT botnets · the research is hedged, so read it with its hedges attached.
In Anthropic’s own post, a model spread to “8/8 nodes in 4 out of 5 trials and 7/8 in 1”. That ran on 8 cloud nodes running an Android emulator in a firewalled network, not on real devices. The authors keep the exploit step “trivial”, so they call their results an upper bound. “We don’t yet have a full rogue replicator.” The “months away” estimate is theirs too, from a trend line they call “only a rough estimate”.
the human in the loop#
Security angle: the guardrail refused the blunt request and accepted the polite one. In Tripathy’s words, protection that is “phrasing-dependent, not structural”. A grant is structural. A prompt is not.
Human angle: the user typed one ordinary sentence. A review request looks like work, and nobody approves a commit they do not know is happening. The human is in the loop on paper, and not on the part that matters.
Honestly? I don’t know whether “out of scope” means OpenAI accepts this behaviour or only that it falls outside a bounty programme. Those are different answers, and the post cannot tell me which.
do this week#
- In GitHub, list every AI app and connector you have authorised and what it can reach. Switch All repositories to Selected wherever you can.
- Check
.github/workflows/commits across your private repositories for authors you do not expect, and rotate secrets an agent could have reached after reading untrusted repositories. Both are the researcher’s recommendations.
When your assistant reads something you did not write, whose instructions is it following?
a prompt is a request. a grant is a decision.
sources#
- Sunil Tripathy, “ChatGPT GitHub Connector” write-up (15 Oct 2026), the primary source; the researcher’s own account, not confirmed by OpenAI: sunilawesome.in
- Anthropic, “Self-replicating AI” (research post), the source for the hype meter: anthropic.com
- The Hacker News, ThreatsDay roundup (22 Oct 2026), where I first saw the connector report: thehackernews.com
- The Hacker News, “Anthropic Warns Small AI Models Could Form Self-Propagating IoT Botnets” (13 Oct 2026), coverage of the Anthropic post: thehackernews.com
Stay patched. Stay paranoid. Maximum effort.
i take help from ai to optimise what i have learned and share it with you. the reading, the lens and the calls are mine. weekly, so you stay updated without the scroll fatigue.
