project
GitHub's built-in CI/CD platform that runs automated build, test, and deployment workflows defined in .github/workflows files.
No evidence-backed relationships are recorded.
Anthropic's CI job volume grew 25x in six months as coding agents raised pipeline load, The New Stack reports. Faster runners and test selection cut the cost of each run, yet repo tests still mock the service seams where distributed systems break.
Reality
Bouras, Dai and Mechtaev found a static denylist let 46 of 75 prompt injections execute in a coding agent, against 3 under preflight-scoped capabilities. A same-day Google report of malware stealing OIDC tokens from GitHub Actions runners puts the outer limit on an agent in the CI job's permissions.
Reality
Go 1.27 ran none of a poisoned module's code on go get, go build or go vet in a replay of npm's August 4 worm, but go test ran it with GITHUB_TOKEN in reach. Go teams still carry exposure through CI test runs, versions that stay cached for good, and bots that edit go.mod.
Reality
GitHub let npm trusted publishing move dist-tags with short-lived OIDC credentials on 2026-09-30, behind a permission that ships switched off. It closes the gap that sent teams back to a long-lived token just to point latest at a new release.
Reality
Two actions-cool GitHub Actions hijacked on May 18 came back online on September 16, still serving the Mini Shai-Hulud stealer to tag-pinned workflows. Only workflows pinned to a pre-May 18 commit SHA escaped; the rest have CI secrets to rotate.
Perspective Coverage
3 publishersReality
WorldScript Studio tracks fifteen automated reviewers in a JSON registry, and only four deterministic security scanners may block a merge. The design keeps LLM false positives off the merge path and keeps pull-request code away from the checker that judges it.
Reality
One homelab operator's Temporal workflow polls GitHub every 30 seconds and dispatches one-job Nomad runners, retiring six idle per-repo runners. Each runner stays bound to one repo, but code now mints the tokens and capacity is reserved only while a job runs.
Reality
One news bot built on APITube's feed sent X only 5 of a day's 270 stories, because X bills $0.200 for every post carrying a URL. Its X budget is a source-rank threshold. The $30 monthly bill moves with how many top-ranked outlets publish each day.
Reality
Socket says workflows using issues-helper@v2.2.1 re-ran Mini Shai-Hulud after the Action was re-enabled on September 16 with its malicious tags intact. The earlier takedown only made those jobs fail, so the fix that holds is dropping the Action or pinning a verified commit SHA.
Reality
Copilot Autofix swapped an env-var-and-jq pattern for inline interpolation in a public GitHub Actions file, and Wiz's autonomous agent exploited it inside a week.
Reality
Wiz says its Red Agent found and exploited a GitHub Actions injection that an AI "autofix" commit introduced five days earlier, reaching Snowflake's internal Jira with no human in the loop.
Perspective Coverage
4 publishersReality
Origin arrives opt-out on every paid Cursor plan with no published terms on retention, residency or training use. GitHub's reliability record is what makes the pitch land.
Perspective Coverage
4 publishersReality
Ransomnews says it found more than 50,000 exposed Stripe merchant secret keys and tested a sample. One live key to a customer list and a test charge took 17 hours.
Reality
The August 17 postmortem describes a sidecar that hit its concurrency limit while its autoscaler measured the host, then a VS Code retry bug that kept Copilot down hours after everything else returned.
Perspective Coverage
3 publishersReality
SHA pinning drew a clean line through the tj-actions compromise, and then Dependabot began bumping hashes faster than anyone could read them. The claim worth enforcing is the version comment that nothing verifies.
Reality
Mandiant's findings say the intrusion never reached Checkmarx One or production AWS, and that answers the vendor's question rather than the one a customer has about what a build box pulled in late March.
Reality
Lorin Hochstein rates Buildkite's public write-up above GitHub's on detail, and the first thing his own retelling has to do is teach clusters, nodes and headroom, the layer a platform keeps out of sight.
Reality
Linear rebuilt its CI pipeline after its CTO filed an issue about cost, and the numbers it published show verification volume growing faster than the savings on each test. The largest wall-clock gains came from the jobs that decide what to run.
Reality
CrowdSec kept a leaver's GitHub access open so he could finish some work, his laptop was hit by the TanStack npm compromise on May 11, and the repositories were copied on May 22 and posted to a forum on September 16.
Perspective Coverage
7 publishersReality
Three versions of MemTensor's MemOS Cloud plugin on npm and MemoryOS 2.0.34 on PyPI launch a Go stealer called sckit that reads the host environment and the user's prompt text, and the npm versions are still installable.
Reality
Build · September 24, 2026 · 1 publisher
Science · September 23, 2026 · 2 publishers
Security · September 23, 2026 · 1 publisher
Build · September 23, 2026 · 1 publisher
Build · September 23, 2026 · 1 publisher
Build · September 22, 2026 · 1 publisher
Build · September 22, 2026 · 1 publisher
Product · September 22, 2026 · 1 publisher
Build · September 22, 2026 · 1 publisher
Product · September 21, 2026 · 1 publisher
Build · September 21, 2026 · 1 publisher
Build · September 20, 2026 · 1 publisher
Build · September 20, 2026 · 1 publisher
Build · September 20, 2026 · 1 publisher
Build · September 20, 2026 · 1 publisher
Build · September 19, 2026 · 1 publisher
Build · September 19, 2026 · 1 publisher
Build · September 19, 2026 · 1 publisher
Build · September 18, 2026 · 1 publisher
Build · September 18, 2026 · 1 publisher
Build · September 18, 2026 · 1 publisher
Build · September 18, 2026 · 1 publisher
Build · September 18, 2026 · 1 publisher
Build · September 18, 2026 · 1 publisher
Build · September 18, 2026 · 1 publisher
Build · September 17, 2026 · 1 publisher
Build · September 17, 2026 · 1 publisher
Build · September 17, 2026 · 1 publisher
Build · September 17, 2026 · 1 publisher
Build · September 16, 2026 · 1 publisher
Build · September 16, 2026 · 1 publisher
Build · September 15, 2026 · 1 publisher
Build · September 15, 2026 · 1 publisher
Build · September 14, 2026 · 1 publisher
Build · September 14, 2026 · 1 publisher
Build · September 13, 2026 · 1 publisher
Build · September 13, 2026 · 1 publisher
Build · September 13, 2026 · 1 publisher
Build · September 13, 2026 · 1 publisher
Build · September 13, 2026 · 1 publisher