AutoGPT v0.4.2 leaks GitHub credentials to attacker-controlled Git server via URL rewriting

Auto-published from arXiv:2609.31318 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.78, flags: [possible-zero-day, no-prompt-excerpt])

Category

tool-misuse

Model

gpt-5.1-codex

Surface

agent harness (AutoGPT v0.4.2)

Setup

The AgentXploit Analyzer Agent traces a path where AutoGPT's clone_repository utility accepts an LLM-provided HTTPS repository URL and rewrites it by inserting configured GitHub credentials as HTTP Basic Authentication before connecting to the remote Git server. An attacker who controls the destination URL (e.g., by supplying a malicious repo URL as a task input) receives the embedded credentials. No verbatim exploit payload is published per the paper's responsible-release policy, but the dataflow chain (source: llm_output.repository_url → transformation: credential insertion → sink: remote Git connection → effect: credential disclosure) is described in Appendix C.1.

Reproduction anchor

code: https://github.com/lwd17/AgentXploit (AgentXploit-Bench, AutoGPT target instance); Appendix C.1 details the full dataflow trace

Observed behavior

AutoGPT inserts GitHub credentials into the attacker-controlled repository URL and transmits them to the attacker's server during the Git clone operation, disclosing deployment secrets without any user warning.

Expected behavior

The agent should validate that repository URLs resolve to trusted, allowlisted hosts before inserting credentials, or use a credential helper that never embeds secrets directly in URLs.

Reproducibility

medium

Threat model

A red-teamer or malicious task author who can supply a repository URL to an AutoGPT-based production deployment can harvest GitHub tokens from the server environment, enabling unauthorized repository access or lateral movement into connected CI/CD pipelines.

Novelty

Demonstrates a novel 'attacker-controlled destination' class of LLM-mediated credential leakage, discovered automatically by a static dataflow analyzer without any prior human knowledge of the vulnerability — a pattern invisible to traditional SAST tools that lack LLM-tool-interaction awareness.

Source

• arXiv: 2609.31318
• PDF: https://arxiv.org/pdf/2609.31318
• Categories: cs.CR, cs.AI
• Authors: Weida Liang, Shi Qiu, Zhun Wang, Simon Sure, Xiaoyuan Liu, Tianneng Shi, Zhaorun Chen, Wenbo Guo, Dawn Song

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 3
• triage reason: Presents AgentXploit-Bench: 72 reproducible vulnerabilities across 12 open-source AI-agent systems (path traversal, injection, tool misuse) with 59.3% end-to-end exploitation success. Recent submission with unreferenced vulnerabilities and no explicit vendor-disclosure statement.

─────────────────────────────────────────────────────────────────────