In Operation Muck and Load, over 200 GitHub repositories serve a Go module that leads to Windows malware infections.

AI coding agents ported Fields Medalist Terence Tao’s Java 1.0 math visualizations to JavaScript in hours, identified two ...

ActiveState explains how GitHub Actions attack chains can evade traditional CI security scanners, why passing a scan doesn't ...

Most widely cited AI coding benchmarks, including the original SWE-bench, were built primarily around Python repositories, meaning headline performance results may not accurately predict how coding ag ...

GitHub also launches Codex as an agent provider in JetBrains IDEs and rolls out AI credit pools giving enterprise admins ...

Alan Turing Institute researchers made GitHub Copilot produce harmful content it refuses in chat, by spreading the request across a coding workflow.

A PNG hiding a prompt injection could steal your repo's secrets, researchers demonstrate. The technique, dubbed 'Ghostcommit, ...

Cybersecurity firm Novee has identified a GitHub Actions workflow-chain risk that can expose secrets even when checks pass, ...

Multiple threat actors are abusing the GitHub API to discover organizations’ repositories and members via ghost accounts.

GitHub's former CEO launches a distributed Git network built for the agentic coding age ...

A prompt injection attack can trick GitHub’s preview Agentic Workflows into retrieving content from private repositories and ...

The issue affects GitHub Agentic Workflows setups that read public input, hold private repo access, and can post output ...