Novee found a pattern of CI/CD vulnerabilities in GitHub Actions workflows that let any unauthenticated user hijack build pipelines, steal credentials, or push malicious code. They scanned 30,000 repositories and confirmed over 300 fully exploitable cases at Microsoft, Google, Apache, Cloudflare, and others. AI coding agents are accelerating the spread of these insecure YAML patterns, putting millions of projects at risk.