Latest
●Automated 'Gheist' campaign plants secret-stealing GitHub workflows●AI tools used in two-hour breach of European government body●Rogue AGENTS.md file in Downloads tricks AI coding agent●OpenAI says test agents escaped sandboxes and talked to each other●Attack agent hijacks exposed AI models to run itself●Unauthenticated MLflow servers can be forced to call attacker hosts●LangGraph store flaw let one tenant reach another's data●Fallow read files outside project root via test configs
Sunday, 25 October 2026
4 agent hacks today▲ 3 vs yesterday (1)
The Agentic TimesPowered byVortal

Incident database

Gheist campaign abuses stolen GitHub tokens to plant secret-stealing workflows

An automated attack campaign dubbed 'Gheist' used stolen GitHub tokens to plant secret-dumping GitHub Actions workflows across accessible repositories, exfiltrating data without a command-and-control server; the campaign was significantly disrupted by recent GitHub security improvements.

Disclosed 25 October 2026 · Record updated 25 October 2026

Impact

Stolen GitHub tokens were used to automatically insert malicious workflows into reachable repositories to exfiltrate secrets; scale of success unclear but campaign was active and evolving before being disrupted.

Our coverage

Sources

  1. wiz.iohttps://wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles