OSINT for AI Red Teams: 2026 Automated Reconnaissance Frameworks Harvesting GitHub Actions Secrets via GitHub API Vulnerability CVE-2025-23259 for Model Poisoning Datasets

Executive Summary: Open-Source Intelligence (OSINT) reconnaissance frameworks in 2026 are increasingly weaponized by AI red teams to automate the extraction of sensitive secrets from GitHub Actions workflows. A critical vulnerability in the GitHub API (CVE-2025-23259) enables unauthorized access to workflow secrets, facilitating the poisoning of AI training datasets with malicious or misleading data. This article examines the operationalization of such frameworks, their technical underpinnings, and the implications for AI model integrity and security.

Key Findings

• Automated OSINT Reconnaissance: AI-driven frameworks in 2026 use LLMs and GitHub API abuse to harvest secrets from public repositories at scale.
• Exploitation of CVE-2025-23259: A patched but still prevalent API misconfiguration allows read access to GitHub Actions secrets not intended for public exposure.
• Model Poisoning Risk: Harvested secrets and metadata are repurposed as adversarial data to manipulate AI model behavior during fine-tuning or pre-training.
• Operational Maturity: Red teams deploy modular, containerized reconnaissance suites that integrate with CI/CD pipelines to exfiltrate and normalize data for AI poisoning.

The Evolution of OSINT for AI Red Teaming

By Q2 2026, OSINT has transcended traditional passive data collection. Modern AI red teams leverage autonomous agents—often referred to as ReconGPT or SecHarvester—that orchestrate multi-stage reconnaissance using large language models (LLMs) to interpret workflow syntax and identify high-value secrets.

These agents parse GitHub Actions YAML files, identify `secrets` references, and chain API calls to the GitHub REST and GraphQL endpoints. While GitHub enforces access controls, a class of misconfigurations—culminating in CVE-2025-23259—remains exploitable due to delayed patching across enterprise instances and third-party GitHub Enterprise Cloud deployments.

CVE-2025-23259: The GitHub API Misauthentication Flaw

Disclosed in March 2025 and assigned CVE-2025-23259, this vulnerability stems from inconsistent OAuth token validation in the GitHub API when accessing repository secrets via the `actions/secrets` endpoint. An attacker with read access to a repository (even without admin privileges) can craft API requests that leak secret values intended for use only within encrypted workflow environments.

Red teams exploit this by:

• Enumerating workflow files via the GitHub API.
• Constructing GraphQL queries targeting `secret` nodes under `workflow` objects.
• Using leaked secrets as seeds for adversarial data generation or as direct inputs for model poisoning.

While GitHub issued patches in April 2025, many organizations had not applied them by year-end due to operational constraints, leaving a significant attack surface.

Automated Reconnaissance Frameworks in 2026

Reconnaissance frameworks have matured into end-to-end pipelines. A typical 2026 setup includes:

• Discovery Module: Uses an LLM to parse GitHub repository metadata, README files, and dependency graphs to identify high-value targets (e.g., repositories with AI model weights or CI/CD pipelines).
• Secret Harvesting Module: Automates API calls to extract secrets via CVE-2025-23259 or through exposed workflow logs in public repositories.
• Normalization & Enrichment Layer: Structures harvested secrets and associated metadata (e.g., job names, environment variables) into JSON-L or YAML datasets suitable for AI ingestion.
• Adversarial Data Generation: Applies prompt injection, label flipping, or noise injection to convert harvested data into adversarial samples for model poisoning.
• Exfiltration & C2 Integration: Outputs poisoned datasets to adversary-controlled storage (e.g., S3, Hugging Face Datasets) or directly into compromised CI/CD pipelines for model retraining.

These frameworks are increasingly containerized and orchestrated via Kubernetes, enabling rapid scaling across cloud environments.

GitHub Actions Secrets as Model Poisoning Vectors

Model poisoning via OSINT-sourced secrets introduces a novel attack vector. Unlike traditional data poisoning, which targets training data, this method exploits the trust placed in AI-generated content derived from compromised pipelines.

For example:

• A red team harvests AWS_ACCESS_KEY_ID and SECRET_ACCESS_KEY from a public GitHub Actions workflow.
• These credentials are used to spin up cloud resources that generate synthetic training data (e.g., fake logs, synthetic user interactions).
• The data is uploaded to public model hubs, where legitimate fine-tuning jobs ingest it, embedding adversarial signals into the model.

This technique leverages legitimate CI/CD trust chains to propagate poisoned data, bypassing traditional input validation controls.

Defensive Strategies and Mitigations

To counter this threat, organizations must adopt a multi-layered strategy:

• Patch Management: Prioritize updates for GitHub Enterprise and ensure OAuth token validation is enforced across all API endpoints.
• Secret Scanning: Enable GitHub Advanced Secret Scanning and push-based scanning in CI/CD to detect exposed secrets in real time.
• Repository Hardening:
• Restrict read access to workflow files via repository rulesets.
• Use environment secrets scoped to protected branches only.
• AI Supply Chain Security: Scan all third-party datasets and models for adversarial patterns using automated tools like PoisonGuard or TrustLLM.
• Zero-Trust CI/CD: Implement runtime secret masking and ephemeral tokens that expire after job completion.