Phantom of the Pipeline Abusing Self Hosted CI

The talk covers abusing self-hosted runners in GitHub Actions. Organizations use them to cut costs, run custom hardware and reach internal networks, but they are not ephemeral by default, so jobs run directly on the host. The attack starts with a leaked personal access token found in artifacts, logs or secret scanning, then uses API queries to reveal the token's scopes and reachable organizations.

Much of this activity leaves little trace. Most read API calls and git clones produce no audit log entry unless an organization pays for the top enterprise tier, and IP logging must be enabled manually. Repo and workflow scopes let an attacker push a malicious workflow, while repo scope alone allows editing scripts that existing workflows call. Persistence can come from a detached Docker container or background process that survives job cleanup. Public repositories add a hurdle because pull request runs need maintainer approval, which often gets skipped for first-time contributors after a small documentation change. The team released Gato, an open-source toolkit for search, enumeration and attack.

A live demo ran the toolkit against a demo organization, listing the token's permissions and vulnerable repositories, then executing a command on a runner and optionally deleting the run log. The takeaway is that one stolen token with the right scopes can give an attacker a foothold on internal infrastructure with no obvious audit trail. Defenders should audit token scopes, isolate runners, treat self-hosted runners on public repositories as risky, and log activity on the runner itself.