buildConfirmed2 publishers GhostAction attackers used roughly 1,900 hijacked GitHub accounts to plant credential-stealing workflows in over 30,000 repos. No GitHub Actions flaw was involved, so defence means rotating exposed keys and reviewing who edits workflows.
Perspective Coverage
3 publishers
- Builder
- Builder 38%
- Operator
- Operator 52%
- Investor
- Investor 10%
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence72
buildOne report1 publisher Six controls cap the damage when an AI agent holds your credentials, a nine-incident review argues
A dev.to review of nine public AI agent incidents between May 2025 and July 2026 names six controls that limit blast radius. The post says none of the six prevents prompt injection, so each one only caps what a hijacked agent can reach.
Reality
- Evidence42
- Adoption
- Not scored
- Hype gap+8
- Incentives
- Not scored
- Confidence45
buildOne report1 publisher GhostAction's October workflow ran where September's mostly stalled, Socket reports
Two compromised maintainer accounts pushed a GhostAction workflow into 346 GitHub repositories on Oct. 8, according to Socket's research team. GitGuardian, which named the campaign, is still reviewing the wave against its own data.
Publishers:blog.gitguardian.com · dev.to Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+8
- Incentives
- Not scored
- Confidence60
GhostAction's credential-stealing GitHub workflow has reached tens of thousands of repositories through more than 500 accounts since October 7, Socket says. Any repository carrying the file should be treated as having lost its Actions secrets and every key in its git history.
Reality
- Evidence58
- Adoption70
- Hype gap+8
- Incentives
- Not scored
- Confidence62
buildOne report1 publisher Models that notice their hacking target is real mostly stop without reporting it
In a Kaggle benchmark of 15 AI models, 73% of answers that recognised their target was a real company told no one and stopped. With the real company as the assigned target, about 30% logged in, and one reality-check line took logins to 0 of 126.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+15
- Incentives55
- Confidence40
buildOne report1 publisher WorldScript Studio gives merge-blocking power to four of its fifteen automated reviewers
WorldScript Studio tracks fifteen automated reviewers in a JSON registry, and only four deterministic security scanners may block a merge. The design keeps LLM false positives off the merge path and keeps pull-request code away from the checker that judges it.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+10
- Incentives55
- Confidence45
AI-assisted commits leak secrets at roughly double the human rate in GitGuardian's 2026 data
GitGuardian's 2026 State of Secrets Sprawl Report says commits identified as AI-assisted leak secrets at about twice the rate of human-written ones. Agent and MCP config files also keep plaintext keys on developer machines where commit scanning and code review never look.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence35
GitHub lets enterprise owners export every token that can reach their code
Enterprise Cloud owners can now pull owner, scope, expiry and last-use data for SSH keys, PATs and app tokens as a CSV. The export stops at credentials GitHub issued, so secrets pasted into repositories stay out of scope.
Reality
- Evidence58
- Adoption20
- Hype gap+5
- Incentives70
- Confidence62
buildOne report1 publisher A key in a test widget moved GoodBarber's secrecy decision into deterministic code
On July 22 a model wrote a forty-character API key into a page's JavaScript and declared the API not secret. GoodBarber now has the model state only how a key is sent and lets code default every key to secret.
Reality
- Evidence57
- Adoption20
- Hype gap+10
- Incentives55
- Confidence52
buildOne report1 publisher The credential an agent inherits sets the ceiling on the damage
GitGuardian argues that credentials and permissions decide how bad an agent incident gets. Checked against the three 2026 disclosures it cites, the argument holds up, and only one of the three involved steering a model.
Reality
- Evidence60
- Adoption45
- Hype gap+15
- Incentives82
- Confidence55
buildOne report1 publisher ChainDrop executes from a checked-in agent config the moment a coding session starts
GitGuardian says the ChainDrop worm reached 444 npm packages by planting a SessionStart hook in Claude Code and a folderOpen task in VS Code, and the publishing credential it steals is used to republish inside the same session.
Reality
- Evidence45
- Adoption55
- Hype gap+22
- Incentives80
- Confidence42
buildOne report1 publisher 64% of secrets leaked in public repos in 2022 still worked when GitGuardian retested in January 2026
GitGuardian retested credentials it had found in public repositories four years earlier and most still authenticated. The figure is really about who is assigned to invalidate a key.
Reality
- Evidence34
- Adoption
- Not scored
- Hype gap+30
- Incentives88
- Confidence55
A stray Railway token let a Cursor agent delete PocketOS's production database in nine seconds
The token was unrelated to the task the agent was given, and its blanket GraphQL permissions covered the volume-level backups too. GitGuardian counts 24,008 secrets in public MCP config files, 2,117 of them still valid.
Reality
- Evidence34
- Adoption45
- Hype gap+32
- Incentives80
- Confidence55
Public GitHub took on 28.65 million hardcoded secrets across 1.94 billion commits in 2025
GitGuardian counted a 34 percent rise in new leaked secrets against 43 percent growth in commits, so the rate per commit slipped about six percent even as the raw total set the company's single-year record.
Publishers:blog.gitguardian.com
Reality
- Evidence42
- Adoption66
- Hype gap+28
- Incentives80
- Confidence55
6,935 exposed Ollama servers answered an internet scan without asking for credentials
Mysterium VPN counted 36,769 self-hosted AI endpoints reachable from the public internet. Ollama is the only population where the scan can prove that nothing on the host asked for credentials.
Reality
- Evidence60
- Adoption70
- Hype gap+12
- Incentives70
- Confidence58
buildOne report1 publisher Plaintext secrets on developer laptops shift attack risk from phishing to endpoint harvesting
Verizon's 2026 report puts credential abuse in 39% of fully traced breach chains. GitGuardian's account of how infostealers work explains why the developer endpoint is the cheapest place to collect them.
Reality
- Evidence45
- Adoption40
- Hype gap+22
- Incentives78
- Confidence42
GitGuardian finds a Shai-Hulud variant sweeping 469 credential paths across CI/CD and AI configs
The count of places this worm looks for secrets more than doubled between builds, and the additions sit in CI/CD and developer tooling, which is where the standing tokens that make a supply chain attack portable actually live.
Reality
- Evidence44
- Adoption
- Not scored
- Hype gap+26
- Incentives78
- Confidence52
buildOne report1 publisher Automated /.env scanning collected 1,033 live Stripe keys from 669 unrelated stacks
The keys work because they are keys. A standard sk_live carries refunds and sometimes payouts. The fix that matters today is rotation. The fix that lasts is a document root that refuses to serve dotfiles.
Reality
- Evidence54
- Adoption31
- Hype gap+9
- Incentives44
- Confidence52
buildOne report1 publisher Every one of thirteen named 2025-26 incidents ran on a credential that still worked
Anthropic, Sysdig, Unit 42 and GitGuardian describe the same shape of failure, which puts the interesting number on your side of the fence: how long an issued token keeps working after it leaves your control.
Reality
- Evidence27
- Adoption44
- Hype gap+37
- Incentives71
- Confidence57
buildOne report1 publisher Time to revoke: the two timestamps a closed ticket cannot give you
A dev.to guide defines the metric as confirmed invalidation minus validation, and names the four timestamps per incident that make it reportable. Cleanup does not stop the clock.
Reality
- Evidence38
- Adoption
- Not scored
- Hype gap+18
- Incentives76
- Confidence52