/QAble Weekly/Vol. 021 · 13 Nov 2026

● This week’s signal » The accounts that build, test and release your code now hold the keys to everything else. Attackers have noticed before most teams have.

Weekly

Signal Over Noise

‹ PrevNext ›

For Engineering
Leaders

5-minute read

‹ PrevNext ›

Friday, 13 November 2026 · Vol. 021

In Brief

WebdriverIO bot used to push a CI stealerNov 11
Nvidia falls 8.6% after hoursNov 11
Anthropic discloses a $26B private placementNov 11
CoreWeave reports $3.66B in quarterly revenueNov 10
wfx CI stealer campaign beginsNov 10
Anthropic releases Claude Fable 5.2Nov 9
Malicious bee-js published to npmNov 9
WebdriverIO bot used to push a CI stealerNov 11
Nvidia falls 8.6% after hoursNov 11
Anthropic discloses a $26B private placementNov 11
CoreWeave reports $3.66B in quarterly revenueNov 10
wfx CI stealer campaign beginsNov 10
Anthropic releases Claude Fable 5.2Nov 9
Malicious bee-js published to npmNov 9

Story of the Week

A CI secret stealer ran in 1,806 repositories, and reached a test framework through its bot

Starting at about 12:45 UTC on 10 November, an attacker logged in to GitHub as real developers and bots using stolen credentials, and opened probe pull requests titled “docs: dependency audit notes.” Aikido Security counted 4,837 compromised accounts and 61,764 repositories probed. Where an account had write access, the attacker pushed a commit that ran a stealer the researchers call wfx inside GitHub Actions. It dumped the secrets and variables passed to the workflow, read the runner’s memory, and tried to exchange GitHub’s OIDC tokens for AWS, Google Cloud and Azure sessions. Aikido found signs that it ran in at least 1,806 repositories, and warned the number may understate the impact. Then it covered its tracks. In Aikido’s words, “the threat actor reverts within at most one minute and deletes the workflow run, along with its logs”, though other researchers found some changes left in place for longer. One target was WebdriverIO, the browser test framework. On 11 November, two commits pushed as the project’s bot account, which was allowed to bypass branch protection, set a postinstall hook to run a credential stealer of roughly 1,500 lines on every install. StepSecurity and SafeDep say the bot’s commits reached 28 WebdriverIO repositories, and that no package release was affected, though the bot’s token should be treated as stolen. A contributor flagged the commits within about 20 minutes.

Why it matters: A bot account with bypass rights is a maintainer that never takes a holiday and never questions a commit. Attackers value it accordingly. Rotating secrets is not enough after a run like this. The stealer also tried to leave backdoors in AWS and Azure that survive rotation. A gap in your workflow run numbers may be the only trace. Check the history, not just the current state of the branch.

WeeklySection 01 · This Week’s Launches

Product Launches

Anthropic says Claude writes over 90% of changes merged into its core codebase, as GitHub moves pull requests into chat

What: Anthropic released Claude Fable 5.2 and said Claude now writes over 90% of the changes merged into its core codebase, while GitHub let developers open pull requests from a Slack or Teams thread.

On 9 November, Anthropic released Claude Fable 5.2, available on its own platform and through Amazon Web Services, Google Cloud and Microsoft Azure, at $8 per million input tokens and $40 per million output tokens. It says testers found outputs up to 30% faster than version 5.1, and that a companion model, Claude Mythos 5.2, is limited to vetted organisations working in dual-use areas such as cyber security and biomedical research. GitHub began rolling Fable 5.2 out to paid Copilot plans the same day. The line in the announcement that matters most for quality teams is not a benchmark: “Over 90% of the changes merged into Anthropic’s core codebase are now written by Claude (with human guidance).” Three days earlier, GitHub made @GitHub in Slack and Teams generally available. From a chat thread, it can investigate bugs, file issues, make code changes and open pull requests, and anything it creates carries the line “Created from a Slack/Teams conversation with @username” in its description.

Why it matters: When most merged code is written by a model, review and testing become the main human contribution to quality, not a step at the end. A pull request that starts in a chat thread needs the same tests and reviewers as one that starts in an editor. Check that your rules apply to both. GitHub’s attribution line is a good habit to copy: every change should say where it came from and who asked for it.

Launch Log

Claude Fable 5.2
Released on 9 November on Anthropic’s platform, AWS, Google Cloud and Azure, at $8 and $40 per million input and output tokens, and rolling out to paid GitHub Copilot plans the same day.
@GitHub in Slack and Teams
Generally available on 6 November: investigate bugs, file issues, make changes and open pull requests from a chat thread, with each item noting its origin.
Secret scanning for Actions logs
Public preview on 9 November for GitHub Enterprise Cloud customers with Secret Protection or Advanced Security: secret scanning now checks workflow logs for leaked credentials. It is off by default.
Spacefast by Automattic
Launched on 9 November after a September soft launch, to host apps and sites built with AI assistants and coding agents, with databases, authentication, file uploads, email and analytics.

WeeklySection 02 · Frameworks & Failures

Frameworks

Treat every bot token as a production credential

Both incidents this week ran through automation with too little oversight: a bot account that could skip branch protection, and a release workflow that published when given a release on an unsigned tag. The controls that would have helped are not new, but most teams have not applied them to bots. First, list every automation identity and what it can do: bot users, deploy keys, GitHub Apps and personal tokens used by CI. Second, remove bypass rights wherever you can, and require a code owner’s review for changes to workflow files and install scripts. Third, cut the blast radius. Make the default workflow token read-only, scope cloud OIDC trust to specific repositories and branches, and run npm ci --ignore-scripts in CI where you can. Fourth, control what leaves the runner, with an allowlist for outbound traffic, since StepSecurity says this stealer sent data to raw IP addresses and later to Telegram. Fifth, watch for the evidence attackers delete: gaps in run numbers, new lifecycle hooks and releases with no matching reviewed change. Endor Labs’ advice applies to all of it: rotating keys “is necessary but not enough: also remove the backdoors” an attacker has left behind.

Why it matters: Bots usually have more access than the people who configured them, and far less scrutiny. A release should be traceable to a reviewed change. If it is not, it should not publish. Rehearse a full rotation of CI secrets before you need one. The first attempt during an incident is always slower than expected.

Failures & Data

A release pipeline published malware, and a database spike took monday.com down for an hour

Just after midnight UTC on 9 November, a GitHub release on an unsigned tag triggered the release workflow for @ethersphere/bee-js, a JavaScript library for the Swarm network, and the project’s own automation published version 13.3.0 to npm. According to Socket, two compromised GitHub accounts were behind it, and the release carried a postinstall loader that downloaded code from an attacker’s server and ran it. The package was the default “latest” version for about 75 minutes before npm removed it, and a malicious Swarm Desktop release, 0.56.2, could be offered to Windows and Apple Silicon users through the app’s auto-updater. On 6 November, the same attacker had tried and failed to harvest credentials from Ethersphere’s CI. GitHub’s advisory is blunt: “Any computer that has this package installed or running should be considered fully compromised.” Later that day, monday.com customers on its US server lost access to the platform. Its postmortem says they “experienced approximately 60 minutes of full system unavailability.” The cause was “an extreme spike on one of our primary databases.” Engineers significantly increased the capacity of an exhausted database component and added guardrails.

Failures & Incidents

WebdriverIO bot account pushes a credential stealer (Nov 11)
Two commits pushed as the project’s bot bypassed branch protection and set a postinstall hook to run a stealer on every install. No package release was affected, according to StepSecurity and SafeDep.
StepSecurity, SafeDep and WebdriverIO PR 16444
Malicious bee-js release on npm (Nov 9)
The project’s own release workflow published version 13.3.0 with a remote code loader. It was live for about 75 minutes before npm removed it.
Socket and GitHub advisory
monday.com US server outage (Nov 9)
About 60 minutes of full unavailability for US customers, caused by an extreme load spike on a primary database.
monday.com postmortem

The Wider Beat

Anthropic lines up $26 billion of buyers for its IPO as AI stocks swing

On 10 November, Anthropic launched the roadshow for its initial public offering: 825 million shares at $70 to $78 each, to trade on Nasdaq under the ticker ANT. An amended filing, reported by The Motley Fool on 11 November, showed that seven companies had agreed to buy $26 billion of shares at the IPO price in a private placement, with Nvidia and Google taking about $10 billion each. After the market closed on 10 November, CoreWeave, which rents AI computing capacity, reported third-quarter revenue of $3.66 billion, up 168% on a year earlier, and a backlog of $132.5 billion. Its shares had lost more than 40% in the past month; on Wednesday they rose 24.7%, and chip stocks rose with them, Nvidia gaining 2.9%. The rally did not last the evening: Nvidia shares fell 8.6% in after-hours trading on reports that its board was meeting to discuss the future of chief executive Jensen Huang. A week after the S&P 500’s worst day since April 2025, the market is still deciding what AI infrastructure is worth.

WeeklySection 03 · Editor’s Note

By the Numbers · The AI quality gap, quantified

QAble Weekly analysis · sources per figure

4,837

hijacked GitHub accounts used to open probe pull requests in 61,764 repositories

Source: Aikido Security, Nov 12

1,806

repositories where the CI secret stealer ran, at least, a figure Aikido says may understate the impact

Source: Aikido Security, Nov 12

WebdriverIO repositories that received the payload through the project’s own bot account

Source: StepSecurity and SafeDep, Nov 12

~75 min

that a malicious bee-js release stayed live on npm, published by the project’s own release workflow

Source: Socket, Nov 9

Editor’s Note

Viral Patel, Co-Founder of QAble — Viral PatelCo-Founder, QAble

“The most privileged member of most engineering teams is a bot that nobody remembers setting up.”

Which bot in your pipeline can push to your main branch without a review, and who would notice if it did?

When we audit a client’s delivery pipeline, the people are rarely the problem. Engineers have reviews, two-factor sign-in and someone looking over their changes. The bots usually have none of that, and often have more access than anyone.

This week an attacker exploited that gap, among others, at scale. Thousands of hijacked accounts, a stealer that ran in at least 1,806 repositories, and a clean-up routine that deleted its own runs and logs. One of the projects hit was WebdriverIO, a test framework many of us depend on, through a bot account that was allowed to skip branch protection.

The bee-js case is the same lesson from a different angle. Nobody had to sneak a release past the project. Its own release workflow published the malware, started by a GitHub release on an unsigned tag.

What strikes me is that none of this needed a clever exploit. StepSecurity says plainly that the attacker did not exploit a bug in GitHub Actions. As I read it, the attacker used access that already existed, and checks that too few teams apply to automation.

Anthropic’s news this week makes the point sharper. If most of the code at the companies building AI is now written by a model, then the review, the tests and the pipeline are where human judgement lives. They deserve the same scrutiny we give the code itself.

So here is the exercise for this week. List every bot, app and token that can push, merge or publish in your organisation, and next to each one, write down who reviews what it does. Any blank line is your first fix.

WeeklySection 04 · Briefing

Funding & M&A

Nominal $240M · Series C
Daylight $80M · Series B
Coframe $25M · Series A

Research

Aikido Security’s analysis of the wfx campaign
The clearest account of the scale and the cleanup: who was probed, where the payload ran, and why a missing run number is the most reliable sign the payload ran.
Socket’s teardown of the bee-js compromise
A timestamped account of how two compromised accounts and a GitHub release on an unsigned tag led a project’s own release workflow to publish malware, after a failed attempt on Ethersphere’s CI on 6 November.
monday.com’s 9 November postmortem
A short, plain account of a database load spike, what it cost customers and the guardrails added afterwards.

Quote of the Week

“Automation accounts with write access, and especially with bypass rights, are as valuable to this attacker as maintainers.”

StepSecurity, on the wfx campaign

Market Signals

01CI pipelines are now a primary target, because they hold the secrets and cloud access that everything else depends on.
02Automation identities, from bots to release workflows, are becoming the weakest point in software supply chains.
03AI now writes most of the code at one of the companies that build it, which moves the weight of quality onto review and testing.
04Development work is moving into chat tools, which widens the number of places a change can start.
05The AI infrastructure trade is volatile, with surging backlogs and sharp sell-offs in the same week.

Community & Debate

Should bots be allowed to bypass branch protection?

StepSecurity’s view after the WebdriverIO case: “Automation accounts with write access, and especially with bypass rights, are as valuable to this attacker as maintainers.”

StepSecurity

Is a missing log a finding?

The stealer deleted its own workflow runs. StepSecurity argues that deleting the evidence is itself one of the strongest signs of an attack.

StepSecurity

Who reviews the code a model writes?

Anthropic says over 90% of the changes merged into its core codebase are now written by Claude, with human guidance. The open question for every team is what that guidance and review should look like.

Anthropic

Elsewhere in Tech

Anthropic launches its IPO roadshow

825 million shares at $70 to $78, ticker ANT on Nasdaq, with $26 billion of shares placed privately at the IPO price, about $10 billion each to Nvidia and Google.

Anthropic and The Motley Fool, Nov 10 to 11

CoreWeave revenue rises 168%

Third-quarter revenue of $3.66 billion and a $132.5 billion backlog; the shares rose 24.7% the next day.

CNBC, Nov 10

Nvidia shares fall 8.6% after hours

On reports that its board was meeting to discuss the future of chief executive Jensen Huang, hours after a 2.9% gain.

Al Jazeera, Nov 12

IBM and Microsoft launch Imagine Enterprise

A platform to build, run and govern AI agents, with more than 6,000 agents and assets, with IBM Consulting available to deploy and run it.

IBM, Nov 10