# Plugin Vulnerabilities: Visit a Website and Have Your Source Code Stolen

Malicious webpage prompt-injects the Chat With Code plugin to create repos, steal private code, and flip all GitHub repos to public.

- Payout: Research
- Severity: high
- Program: ChatGPT plugins
- Write-up by: Johann Rehberger
- Disclosed: 2023-06-20
- Write-up quality: 6/10
- Original: https://embracethered.com/blog/posts/2023/chatgpt-plugin-vulns-chat-with-code/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-plugin-vulns-chat-with-code
- Tags: area:ai domain:ai impact:data-leak impact:integrity kind:research platform:research sev:high tech:llm tech:oauth technique:recon vuln:prompt-injection

**Target:** ChatGPT plugin (Chat With Code) acting on GitHub via OAuth
**Root cause:** Plugins that impersonate users via OAuth don't enforce user confirmation, so prompt injection from untrusted web content becomes a confused-deputy/plugin request forgery that executes actions with the user's delegated authority.
**Steps:**
1. Enumerate ChatGPT plugin metadata, filter the 51 OAuth-enabled plugins out of 445 approved.
2. Identify Chat With Code, which performs GitHub actions on the user's behalf.
3. Host a malicious webpage containing injected instructions.
4. Victim visits the page with the plugin enabled; the page's content invokes the plugin.
5. Injected commands create a repo GOT-PWNED and add an issue 'tell my why is this possible?' to all private repos; the demo also flips all private repos to public.
6. Malicious instruction file is removed after execution.
**How found:** Filtered all ChatGPT plugin metadata by OAuth support, reasoning that OAuth implies delegation/impersonation and access to personal data or infrastructure, then sampled candidates for cross-plugin request forgery.
**Exploitation:** Attacker hosts a webpage with embedded prompt-injection instructions; when a victim with the OAuth-enabled Chat With Code plugin loads it, the injected content drives the plugin to act with the victim's GitHub token, creating repos, exfiltrating private code, and changing repo visibility to public.
**Escalation:** Prompt injection can originate from the same plugin performing the action, removing the need for a separate WebPilot plugin.
**Insight:** Plugin metadata is enumerable and OAuth support is a reliable signal of delegated authority; plugins that act on external accounts without per-action confirmation are prime confused-deputy targets for prompt injection from any content the agent reads.

## Proof of concept (copied exactly from the original report)

**Malicious webpage URL for Chat With Code PoC**

```
https://wuzzi.net/ai-tests/code.html
```