Critical 2026 AI-Enabled Attack Detection — CI/CD Workflow Permission Escalation and Fork PR Secrets Abuse

Ibrahim Saud@tektrix

•updated Sep 24, 2026•0•0•1

This rule detects potential CI/CD security compromises in GitHub by monitoring for modifications to workflow permissions that grant 'write-all' access, access to sensitive workflow secrets via 'pull_request_target' from forked repositories, and the registration of new self-hosted runners. These actions are common indicators of supply chain attacks aimed at poisoning pipeline execution or exfiltrating build secrets.