On October 25, 2026, Wiz Research published "Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens". Wiz says it has tracked the campaign since September 15, and its status snapshot, dated October 24, describes the activity as ongoing and still changing. The name comes from the user agent, gheist, that the tooling sends to the GitHub API. Wiz writes: "We have recovered more than 13,500 planted branches from more than 850 compromised accounts, ranging from personal projects to enterprise organizations' private repositories."
How the workflow leaks secrets
For every repository a stolen token can reach, the tooling pushes a branch named ci-sync- plus six random characters. The only change is a workflow file, sync-check.yml, committed as the token's owner with the message ci: sync config. The workflow runs on push and prints the environment and the secrets context. The trick is the encoding. Wiz explains that "GitHub masks secret values in logs only when they appear verbatim", and "A base32-encoded secret doesn't match, so it prints in full." The tooling then downloads the log through the GitHub API and deletes the run seconds later. A job matrix also reaches deployment environments, where production credentials tend to live. Because the data leaves through GitHub's own API, there is no attacker domain to block. Setting permissions: {} narrows the workflow token but does not restrict the secrets context.
Where the control held and where it did not
Since July 28, GitHub has held potentially malicious workflow runs in public repositories until a collaborator approves them. Against that hold, Wiz says, "The control worked, and the malicious payloads never ran." The hold does not cover private repositories or GitHub Enterprise Server. There, runs on ci-sync-* branches completed and were deleted, and Wiz saw organisations' own workflows assuming AWS roles from those branches in CloudTrail.
A second tool adds a sync-host job aimed at self-hosted runners. It searches home directories, workspaces and system paths for 31 token formats, which Wiz says include "keys for AI providers such as Anthropic, Hugging Face, Groq and NVIDIA", along with private keys, .env files, Terraform state, shell history, Docker socket access and cloud and Kubernetes credentials. Wiz notes the job contains bugs. It links the stolen tokens most likely to infostealer logs and earlier supply-chain compromises, and reports overlap with lure repositories, cryptomining and other campaigns on the same accounts.
The AI angle connects to a pattern this digest has followed. Railway's preliminary report, covered on October 24, said its attacker was hunting for AI API keys. Wiz does not link the two, and nothing here suggests the same actor; the point is only that AI provider keys are now on attackers' standard search lists.
What remains uncertain. Wiz's figures are its own recovery counts, so the true number of exposed secrets and which of them were used are unknown. Roughly two-thirds of implicated accounts were no longer available on GitHub by October 24, which likely reflects cleanup rather than a complete count.
Analysis: Treat any AI key that sits in CI as a production credential with a large bill attached. If a repository was touched, Wiz's advice is blunt: "Deleting the run or the branch doesn't undo the exposure." Rotate everything that repository's workflows could read. For teams building agent pipelines, three changes cut this class of risk. Prefer OIDC federation scoped to protected branches and environments over long-lived keys in repository secrets. Require reviewers on any environment holding production or model-provider keys, so a push to a stray branch cannot read them. And run self-hosted runners as ephemeral hosts with no Docker socket. The same least-privilege direction shows up in small maintenance changes: on October 25 Google ADK Python removed a pull-requests: write grant from a PR triage job that runs under pull_request_target, noting the grant was unnecessary and would let a compromised step edit pull requests. That commit is housekeeping, not an incident response, but it is the kind of audit every agent repository with automation should run now.
Sources and evidence
Wiz's October 25 Gheist report says stolen GitHub tokens planted more than 13,500 ci-sync branches across more than 850 accounts; each workflow printed base32-encoded secrets that GitHub's verbatim masking missed, then deleted its run. GitHub's public-repository approval hold blocked it, but private repositories and self-hosted runners, where a sweep looked for 31 token formats including Anthropic, Hugging Face, Groq and NVIDIA keys, were exposed. Rotate everything an affected repository could read.