Notifications
Clear all
Topic starter
01/08/2026 8:56 pm
TL;DR: CI/CD pipelines concentrate credentials, runtime access, and trust in CI runners, making them a high-value target for supply chain attacks, according to Abstract Security's analysis of Trivy, reviewdog, and related compromises. The governance gap is not just detection latency but the assumption that pipeline identities are easy to observe and control once code starts executing.
NHIMG editorial — based on content published by Abstract Security: CI Runner Threat Detection for GitHub Action compromises
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
- Internal repositories are 6x more likely to contain secrets than public ones, 32.2% versus 5.6%, contradicting the assumption that private repos are safe.
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation.
Questions worth separating out
Q: How should security teams reduce the blast radius of compromised CI/CD tools?
A: Limit each pipeline to the minimum credentials it needs, separate build from deploy permissions, and remove long-lived secrets from execution environments.
Q: Why do CI runners create such a high risk of secret exposure?
A: Runners often load secrets into memory during execution and, in self-hosted cases, may also retain credentials on disk between jobs.
Q: What do teams get wrong about ephemeral build infrastructure?
A: They assume ephemeral means safe by default.
Practitioner guidance
- Restrict workflow permissions to the minimum viable scope Set explicit read-only or task-scoped permissions on every workflow and remove broad repository or cloud access from runner identities.
- Eliminate long-lived secrets from runner hosts Move cloud, registry, and Kubernetes credentials into a runtime secret manager and fetch them only when a step needs them.
- Treat OIDC and metadata access as privileged attack paths Block unnecessary access to cloud metadata services, constrain federation claims, and require strict conditions before a runner can mint short-lived tokens.
What's in the full article
Abstract Security's full analysis covers the operational detail this post intentionally leaves for the source:
- The exact Tetragon tracing policies used to detect cross-process /proc memory reads and suspicious file access patterns.
- Example detection logic for Runner.Worker memory scraping, temp-directory staging, and reverse shell behaviour.
- Runner-specific hardening guidance for GitHub-hosted, self-hosted, and Kubernetes-based runners.
- The payload-driven analysis of Trivy compromise telemetry and the specific process patterns that surfaced.
👉 Read Abstract Security's analysis of CI runner threat detection and GitHub Action compromises →
CI runner compromises and the governance gap teams are missing?
Explore further
01/08/2026 9:04 pm
CI runner compromise is an NHI governance failure, not just a detection problem. The runner is a non-human identity with temporary but powerful access, and the article shows how quickly that access can be abused once malicious code executes. Identity teams that treat pipelines as simple automation miss the fact that the runner carries production-adjacent trust. The governing question is whether that identity can be constrained to the exact task it needs to perform.
A few things that frame the scale:
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded, according to The State of Secrets Sprawl 2026.
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, according to GitGuardian, which shows why exposure and revocation must be linked.
A question worth separating out:
Q: Who is accountable when a poisoned action exfiltrates cloud credentials?
A: Accountability sits with the teams that defined workflow permissions, secret handling, runner isolation, and federation policy. Security, platform, and identity owners all share responsibility because the failure usually spans IAM, CI/CD, and cloud governance rather than a single control owner.
👉 Read our full editorial: CI runner compromises expose the blind spot in pipeline security
