Cordyceps is a set of CI/CD flaws hiding in plain sight across thousands of open-source repositories. Novee’s team scanned 30,000 high-impact projects, flagged 654 with the pattern, and confirmed over 300 fully exploitable chains. An unauthenticated user with a free GitHub account can trigger workflows—via pull requests or comments—and borrow a maintainer’s permissions to run code, steal tokens or push malicious commits. Those workflows often bridge low- and high-privilege steps, so a single unchecked data pass becomes a full supply-chain compromise. The team found command injections, broken auth logic, artifact poisoning and privilege escalation happening inside GitHub Actions YAML files. AI coding agents make it worse by churning out the same insecure templates at scale. Traditional scanners miss these risks because they treat workflows as configuration, not code. Novee’s Continuous External Attack Validation tool actually executes attack chains and proves both risk and remediation. Concrete examples drove the point home. In Microsoft’s Azure Sentinel repo, a PR comment stole a non-expiring GitHub App key, giving attackers persistent write access to detection rules shipped to customers. Google’s AI Agent Dev Kit sample repo yielded roles/owner on the associated GCP project from a single pull request. Apache Doris was hit two ways: a comment exfiltrated CI credentials, and a forked PR grabbed a full-write token. Cloudflare’s Workers SDK pipeline let a crafted branch name execute arbitrary commands on CI runners. Each flaw affected core infrastructure used by tens of thousands of organizations.