# OpenAI Removes the "Chat with Code" Plugin From Store

Indirect prompt injection in OpenAI's 'Chat with Code' plugin let injected text make ChatGPT flip a victim's private GitHub repos to public without confirmation.

- Payout: Research
- Severity: high
- Program: OpenAI
- Write-up by: Johann Rehberger
- Disclosed: 2023-07-06
- Write-up quality: 6/10
- Original: https://embracethered.com/blog/posts/2023/chatgpt-chat-with-code-plugin-take-down/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-chat-with-code-plugin-take-down
- Tags: area:ai domain:ai impact:data-leak impact:integrity kind:research platform:research sev:high tech:llm tech:oauth technique:chained vuln:prompt-injection

**Target:** OAuth-enabled ChatGPT plugin (Chat with Code) acting on GitHub
**Root cause:** Plugins impersonate the user via OAuth and execute actions without per-action user confirmation; untrusted content (e.g. Link Reader output) can inject instructions that the model follows.
**Steps:**
1. Enable Link Reader and Chat with Code plugins in ChatGPT.
2. Craft attacker-controlled content containing the indirect prompt injection payload instructing the model to act as 'Mallory' and make private repos public.
3. Have the victim load/read that content via Link Reader so it enters the model context.
4. Model invokes Chat with Code as the authenticated user and flips all private repos to public without confirmation.
5. Model prints a summary of changed repos.
**How found:** Prior research into OAuth-enabled plugins being vulnerable to Cross Plugin Request Forgery; a Reddit report of ChatGPT spontaneously creating a GitHub Issue confirmed real-world unintended actions, prompting disclosure of the POC.
**Exploitation:** Attacker plants injected instructions in content the victim's ChatGPT reads (via Link Reader); the model then calls the OAuth-authorized Chat with Code plugin to change private repos to public, and can exfiltrate read data to an attacker server.
**Escalation:** Chaining a read plugin (Link Reader) with a write/impersonating plugin (Chat with Code) to achieve unauthorized state change; read operations can also exfiltrate data to attacker-controlled servers.
**Insight:** OAuth plugins that impersonate the user turn any untrusted text the model ingests into an authenticated action channel; chain a read plugin to a write plugin and note that read ops also enable exfiltration, unlike browser CSRF.