Privilege-based threat analysis and predictive data modeling, 2023–2026
The software supply chain has undergone a profound architectural and operational transformation between 2023 and 2026. Driven by the exponential integration of AI coding assistants and the ubiquitous adoption of CI/CD pipelines, the primary attack surface has shifted decisively. Threat actors no longer focus solely on zero-day vulnerabilities in production servers; instead, they target the developer platforms and automation workflows that deploy to those servers. GitHub, which hosts over 180 million developers, 800 million repositories, and processes nearly one billion commits annually, sits at the absolute epicenter of this shifting threat landscape. Activity on the platform has reached unprecedented levels, with data from the 2025 State of the Octoverse report revealing that developers merge over 43.2 million pull requests monthly.
This massive acceleration in output is inextricably linked to generative AI, which has transitioned from an experimental utility to a foundational engineering requirement. By mid-2026, AI-assisted development generated approximately 46% of the code committed to GitHub. This velocity has introduced a severe security paradox: while developers ship features significantly faster, enterprise security teams are logging a 40% rise in AI-generated vulnerability patterns. The vulnerabilities introduced are rarely novel; rather, they are legacy flaws (hardcoded secrets, injection vulnerabilities, broken access controls) resurrected by AI models trained on historical, imperfect codebases.
To systematically understand and visualize this ecosystem, this report structures the GitHub threat landscape into a hierarchical privilege model. It uses the same four planes ghtier applies elsewhere on this site, spanning from Tier 0 (the highest enterprise infrastructure privileges) down to Tier 3 (the lowest individual user privileges), mapping how attackers exploit authorizations at every level.
Tier 0: Enterprise privileges and platform-level subversion
Tier 0 represents the absolute apex of the privilege hierarchy, encompassing the foundational infrastructure of self-hosted enterprise environments, specifically GitHub Enterprise Server (GHES). Organizations use GHES to maintain sovereign control over proprietary code, often placing it behind rigorous corporate firewalls. A compromise at this tier is catastrophic, allowing attackers to bypass all downstream repository, application, and user-level controls to seize total administrative command.
Between 2024 and 2026, the most critical threats to Tier 0 centered not on network penetration, but on subversion of cryptographic trust in federated identity systems. SAML SSO integrations became the primary vector for maximum-severity exploits. The disclosure of CVE-2024-4985 (CVSS 10.0) in May 2024 exposed a flaw in how GHES handled optional encrypted assertions within SAML responses: the system failed to independently verify the signature of an assertion after it had been decrypted. An attacker could clone a valid SAML response, replace the encrypted assertion with a maliciously crafted one, and bypass authentication because the system erroneously trusted the signature of the unmodified outer envelope, arbitrarily provisioning accounts with site administrator privileges.
Months later, a related and equally devastating flaw, CVE-2024-6800 (CVSS 9.5), revealed an XML Signature Wrapping (XSW) vulnerability rooted in a parser differential between the ReXML and Nokogiri libraries underlying Ruby-SAML. The discrepancy in how each parser interpreted identical XML structures let an attacker mutate a valid, signed message. Identity attributes could be altered while the modified document still passed signature verification. Exploiting it required network access to the GHES instance, but similarly granted complete administrative takeover with no prior authentication.
The second-order insight from these breaches: the complexity of federated identity creates systemic fragility. SAML protocols and encrypted assertions are designed to enforce zero-trust perimeters, yet they become the exact vectors through which those perimeters are absolutely compromised.
Scenario · The Cryptographic Bypass
Maps the anatomy of CVE-2024-6800: an external threat actor intercepts a legitimate SAML login request, exploits the Nokogiri/ReXML parser differential to inject an administrative role claim, and wraps the payload in a valid XML signature. Despite firewalls and VPNs, a single flaw in cryptographic sequence processing results in total loss of enterprise sovereignty.
Tier 1: Organization privileges and the CI/CD supply chain
Tier 1 encompasses the organizational structures, CI workflows, and automated pipelines that dictate how code moves from a repository to production. GitHub Actions (GHA) is the primary automation engine here, and consequently the most lucrative target for software supply chain attacks. An attacker with Tier 1 execution privileges can poison build artifacts, exfiltrate deployment credentials, and embed persistent backdoors across an entire organization's portfolio.
A persistent architectural vulnerability involves misconfiguration of the pull_request_target trigger. Designed to let workflows evaluate pull requests from untrusted forks while retaining access to the base repository's secrets, it runs in the highly privileged context of the target repository. If a workflow explicitly checks out and executes code from an untrusted PR head, it grants attacker-controlled code execution inside a secure runner, a "pwn request" that lets an attacker read injected environment variables and exfiltrate secrets without obvious forensic traces. In early 2026, an automated campaign known as "HackerBot-Claw" systematically scanned public repositories for exactly this misconfiguration, automatically opening hundreds of malicious pull requests to harvest secrets at scale.
The industrialization of malicious third-party dependencies has been just as damaging. The March 2025 compromise of tj-actions/changed-files (used by over 23,000 repositories) saw attackers inject a malicious payload directly into the action's source. Organizations referencing it via a mutable tag or branch, rather than pinning to an immutable commit SHA, automatically ingested the malware on their next pipeline run. This tactic evolved further in late 2025 with "GhostAction," which compromised 327 users across 817 repositories: the malware ran natively inside the CI runner, harvested the built-in GITHUB_TOKEN, deployed the TruffleHog secret scanner to find further lateral movement, and silently pushed secondary malicious commits to other repositories owned by the organization.
In response to endemic over-permissioning, the COSSETER framework (2026 IEEE Symposium on Security and Privacy) introduced demand-driven static analysis to computationally derive the minimum permissions a GitHub Action actually needs. It generates Object Dependency Graphs for JavaScript-based actions and analyzes shell scripts to map API and Git CLI calls, drastically reducing analysis time and shrinking the attack surface of automated workflows.
Scenario · The Poisoned Pipeline
Tracks a supply chain attack from an unpinned, compromised third-party Action (analogous to tj-actions). The malicious action executes inside the CI runner, leverages a permissive GITHUB_TOKEN to read secrets, and uses them to push compromised release artifacts to production; the incident underscores the necessity of SHA-pinning dependencies and enforcing read-only default permissions.
Tier 2: Application privileges and non-human identities
Tier 2 governs interactions between GitHub and external software ecosystems: OAuth applications, GitHub Apps, and the explosive growth of Non-Human Identities (NHIs). The shift toward microservices and automated deployment has caused machine identities to vastly outnumber human ones: by 2025–2026, NHIs outnumbered human identities by a ratio of 144 to 1 in cloud-native environments, a 56% growth in that ratio over a single year.
The most severe disruption has been the rapid integration of agentic AI via the Model Context Protocol (MCP), which requires a vast array of credentials to function. In June 2025, researchers found a critical path traversal vulnerability in the Docker build process of Smithery.ai, a prominent MCP server registry: an unsanitized dockerBuildPath parameter let attackers traverse the filesystem and reach .docker/config.json files alongside high-privileged Fly.io tokens. The flaw compromised over 3,000 hosted AI applications and exposed thousands of downstream users' API keys and database credentials.
MCP's architecture also introduced "Tool Poisoning" (Agentic Workflow Injection): rather than targeting parsers, it targets the tool metadata and descriptions an LLM reads to understand its own capabilities, embedding hidden malicious instructions there. High-capability reasoning models exhibit attack success rates as high as 72.8% against poisoned tools. A January 2026 exploit against Anthropic's claude-code-action showed how simply opening a maliciously crafted GitHub issue could get the triaging agent to ingest the injection, exfiltrate runner environment variables, and push unauthorized code changes.
The OWASP Non-Human Identities Top 10, formalized in 2025, categorizes exactly these threats: long-lived secrets and over-privileged NHIs are the most critical blind spot in modern enterprise security, since machine identities rarely undergo periodic access review and their credentials are rotated far less often than human ones.
Scenario · The Agentic Heist
Based on the Smithery.ai breach: a threat actor publishes a seemingly benign MCP tool with poisoned metadata. When an organization's internal AI agent interacts with it, the hidden prompt injection forces the agent to query the GitHub API with its own authorized token and exfiltrate proprietary source code, illustrating the danger of implicit trust in AI-to-machine integrations.
Tier 3: User privileges and endpoint vulnerabilities
Tier 3 is the foundational layer: the individual developer. Compromising a developer's workstation circumvents all upstream cloud access controls, since the developer already holds legitimate credentials for the repository.
The fragility of this tier was vividly demonstrated in the May 2026 internal GitHub breach, where a group known as "TeamPCP" exfiltrated roughly 3,800–4,000 of GitHub's own private internal repositories. The attack targeted the developer's toolchain rather than a zero-day: TeamPCP poisoned the "Nx Console" VS Code extension and pushed it to the Marketplace. The malicious update was live for only 18 minutes, but the IDE's auto-update was enough. The malware ran entirely within standard user permissions (explicitly avoiding sudo to evade EDR telemetry), harvested 1Password vaults, SSH keys, GitHub tokens, and AWS credentials, and pushed the double-encrypted output to an external repository. With the stolen credentials, TeamPCP cloned thousands of repositories containing GitHub's proprietary platform code.
This breach highlights a systemic credential-management failure. GitHub has pushed users toward fine-grained Personal Access Tokens (PATs), which restrict access to specific repositories and enforce expiration. But adoption is stymied by a functional paradox: fine-grained PATs still can't verify organization-level ownership or read admin role membership, so developers running standard org automation are forced back onto broad, over-permissive classic PATs, defeating the granular model entirely.
The user tier is further strained by AI coding assistants. Per the GitGuardian State of Secrets Sprawl 2026 report, a record 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025, a 34% year-over-year increase. Commits authored with AI assistance leaked secrets at 3.2%, more than double the 1.5% baseline for human-only commits. In response, GitHub unbundled secret scanning into a standalone GitHub Secret Protection product with AI-powered detection for unstructured secrets and mandatory Push Protection, which intercepts git push and scans the delta before it's written, though developers under time pressure frequently seek a delegated bypass, requiring security teams to manually approve forced pushes containing flagged secrets.
Scenario · The IDE Infiltration
Drawn from the May 2026 TeamPCP breach: a developer installs a routine IDE extension update. The malware quietly harvests local tokens and classic PATs from the workstation, bypasses MFA by never needing to touch it, and clones internal repositories. This is a reminder that developer endpoints are now the highest-value attack surface, making endpoint security and strict extension allow-listing mandatory.
Quantitative threat landscape: data and predictive modeling
The following datasets synthesize recent historical telemetry into predicted trajectories through 2028. Solid bars are historical figures; dashed bars are projections built on the stated growth-rate assumptions.
1. Secret sprawl and AI-service leakage
GitGuardian's scanning of public GitHub recorded total leaked secrets growing 152% between 2021 and 2025, reaching 28.65 million new secrets in 2025 (up 34% year-over-year). AI-service credentials (LLM API keys) grew 81% year-over-year in 2025 alone. The 2026–2028 projection applies a conservative 30% CAGR, reflecting AI coding assistants that roughly double the baseline leak rate, moderated by wider Push Protection enforcement.
| Year | Total new secrets leaked | AI-service secrets leaked | YoY growth | Primary driver |
|---|---|---|---|---|
| 2023 | ~18.00M | ~389,000 | 28.5% | CI/CD pipeline expansion and macro-automation |
| 2024 | 23.77M | ~704,000 | 32.2% | Early adoption of conversational AI coding assistants |
| 2025 | 28.65M | 1,275,105 | 34.0% | Mainstream agentic AI and MCP manifest configurations |
| 2026 (proj.) | 37.24M | 2,167,000 | 30.0% | Increased context windows and automated prompt injection |
| 2027 (proj.) | 48.41M | 3,683,000 | 30.0% | Autonomous AI committers lacking human-in-the-loop review |
| 2028 (proj.) | 62.93M | 6,261,000 | 30.0% | Total saturation of AI-generated enterprise codebases |
2. Non-human to human identity ratio
Telemetry from Entro Labs and CyberArk put the 2023 baseline machine-to-human identity ratio at 82:1, surging to 144:1 by mid-2025 (56% growth) on the back of microservices and API integrations. The projection anticipates an accelerating curve as agentic AI matures and individual LLM agents dynamically spawn temporary, highly permissioned identities via MCP.
| Year | Ratio (NHI : human) | Growth | Key architectural shift |
|---|---|---|---|
| 2023 | 82 : 1 | Baseline | Cloud IAM, basic CI/CD runners, standard API tokenization |
| 2024 | 92 : 1 | 12.1% | Kubernetes service accounts, widespread OAuth app proliferation |
| 2025 | 144 : 1 | 56.5% | Model Context Protocol, retrieval-augmented generation |
| 2026 (proj.) | 195 : 1 | 35.4% | AI agent-to-agent negotiation tokens, decentralized execution |
| 2027 (proj.) | 260 : 1 | 33.3% | Autonomous DevOps agents managing infrastructure |
3. Economic impact and remediation failure rates
2026 data found that 64% of secrets leaked in 2022 remained valid and exploitable four years later, a catastrophic industry-wide failure in credential rotation. IBM and SentinelOne data from 2024 put the global average breach cost at $4.88 million, with AI-driven attacks adding roughly $1 million more due to faster exfiltration. Projections assume a steady rise driven by regulatory fines and the expanding blast radius of unmonitored NHIs.
| Metric | 2024 | 2025 | 2026 (proj.) |
|---|---|---|---|
| Valid secrets after 4 years | 70% (from 2020) | — | 64% (from 2022) |
| Average global breach cost | $4.45M | $4.88M | ~$5.25M |
| AI exfiltration cost penalty | +$0 | +$1.0M | +$1.25M |
| Days to identify/contain | 277 | ~260 | ~245 |
Conclusion
The GitHub ecosystem between 2023 and 2026 reveals a fundamental shift: vulnerabilities are no longer isolated software bugs, but are inherently tied to the hierarchical privilege structure of the developer platform itself. From Tier 0 cryptographic bypasses in enterprise identity federation, to Tier 1 poisoning of CI/CD pipelines, to Tier 2 exploitation of AI agents, down to Tier 3 developer endpoint compromises, attackers are systematically mapping and abusing legitimate authorization frameworks.
As AI accelerates developer velocity, the unintended consequence is massive secret sprawl and an uncontrollable proliferation of non-human identities. Countering this means moving away from perimeter defense and toward identity-first security: dynamic, short-lived credentials (OIDC federation), static analysis to strictly minimize GitHub Actions permissions, mandatory push protection with rigorous bypass auditing, and treating every AI integration as an untrusted endpoint requiring human-in-the-loop verification.