# GhostAction: new wave scrapes AI provider keys from 346 repos

> GhostAction's new wave takes AI provider keys out of git history, not just the CI secrets its earlier version stole.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Supply chain, Incident
- **Published by:** Socket
- **Disclosed:** 2026-10-09
- **Affects:** GitHub Actions, PyPI, crates.io, Anthropic API keys, OpenAI API keys, OpenRouter API keys
- **Research by:** [Socket Research Team](https://socket.dev/blog/ghostaction-cloud-credentials)
- **Primary source:** https://socket.dev/blog/ghostaction-cloud-credentials
- **Page:** https://theinjection.dev/items/socket-ghostaction-ai-credential-wave/

A new GhostAction wave added a fake security-audit workflow to 346 GitHub repositories on October 8. Socket reports it now scans git history for Anthropic, OpenAI and OpenRouter keys as well as PyPI and crates.io publishing credentials.

## What happened

Socket's Research Team published the findings on October 9, 2026, a day after the commits landed. Two compromised GitHub maintainer accounts, henrywoo and kitao, added a file named .github/workflows/security-audit.yml to 346 repositories on October 8, 2026. GitGuardian researchers documented the original GhostAction campaign in September 2025.

## How it works

The workflow has no security function and sends what it collects to a hardcoded IP address. One half is inherited from the earlier campaign: it reads GitHub Actions secrets, mainly PyPI and crates.io publishing credentials and a GitHub personal access token. The new half scans the working tree and the full git history for cloud and AI credentials, which widens the blast radius to any key that was ever committed and later removed.

## Who is affected

Maintainers and downstream users of the 346 repositories Socket lists are exposed, along with anyone whose provider keys reached those repositories' history. Socket counted 318 under henrywoo, of which 39 are source repositories and 279 are forks, 27 under kitao, and uber/athenadriver, an Uber-owned repository that henrywoo can write to. The full credential list is below.

## What to do

Rotate any Anthropic, OpenAI, OpenRouter, AWS or registry credential that was present in an affected repository or its CI secrets, and check whether .github/workflows/security-audit.yml sits on your default branch. Socket reports the file was still there on October 9 in the repositories it checked.

## Quick facts

- **Repositories:** 346 (318 henrywoo, 27 kitao, 1 Uber-owned)
- **Workflow file:** .github/workflows/security-audit.yml
- **Committed:** October 8, 2026
- **New in this wave:** Scans working tree and full git history for AI and cloud keys
- **Credentials targeted:** AWS, Anthropic, OpenAI, OpenRouter, GitHub, GitLab, Google, Slack, SendGrid, PyPI, crates.io
- **Status:** Workflow still on default branches as of October 9 (Socket)
- **Packages published:** None to PyPI or crates.io as of publication (Socket)

## Questions

### Which credentials does the new GhostAction wave steal?

The new GhostAction workflow targets two sets. From GitHub Actions secrets it takes PyPI and crates.io publishing credentials and a GitHub personal access token. From the working tree and full git history it takes AWS keys, Anthropic, OpenAI and OpenRouter keys, and GitHub, GitLab, Google, Slack and SendGrid tokens. Socket reports all of it goes to a hardcoded IP address.

### How do I check whether my repository was hit by GhostAction?

Look for a file named .github/workflows/security-audit.yml on the default branch, a name Socket says carries no security function in this campaign. Socket found the file still present on October 9, 2026 in the repositories it checked. Repositories owned or forked by the GitHub accounts henrywoo and kitao are the ones Socket lists as affected.

### Were malicious packages published to PyPI or crates.io?

Socket reports no malicious package versions were published to PyPI or crates.io as of its October 9, 2026 write-up, even though the stolen credentials include publishing tokens for both registries. Socket treats those registry credentials as the main remaining risk, because a stolen publishing token lets an attacker ship a trojaned release under a legitimate name.

### Is the new GhostAction wave the same campaign GitGuardian found?

Socket describes the October 2026 activity as a new wave of GhostAction, the campaign GitGuardian researchers Gaetan Ferry and Guillaume Valadon documented in September 2025 after 3,325 secrets were stolen from 817 repositories. The workflow's secret-stealing half is inherited from that campaign, while the git-history scan for cloud and AI credentials is new.

## Sources

1. [Socket Research Post](https://socket.dev/blog/ghostaction-cloud-credentials)
2. [GitGuardian GhostAction](https://blog.gitguardian.com/ghostaction-campaign-3-325-secrets-stolen/)