Audit of 760 repos: 30% of CI AI agents reachable by outsiders

Researchers manually read 760 public repositories that run Claude, Codex or Gemini via GitHub Actions. In 3 of every 10 repos, someone without repository access can reach the agent or the agent holds more power than its job needs; in 116 repos outsider text reaches an agent with a secret, write token or shell.

• In 280 repos the agent holds a token that can write to the repository
• In 222 repos the agent holds a secret or API key
• In 136 repos the agent can run any command in a shell
• In 52 cases the attack lands on a developer's own computer, not CI