Multiple threat actors are abusing the GitHub API to discover organizations’ repositories and members via ghost accounts.

Researchers have uncovered a sustained campaign using GitHub's public APIs and ghost accounts to profile enterprise software ...

GitHub ghost accounts and exposed PATs scrape corporate orgs through the API, with select cases cloning private repos.

The issue affects GitHub Agentic Workflows setups that read public input, hold private repo access, and can post output ...

GitHub detailed a set of updates to GitHub Spark, including changes aimed at enterprise readiness, cost management, agent behavior, and UI quality. The update is outlined in a Dec. 10 GitHub changelog ...