GitHub Actions Gets Safer Defaults, but Pwn Request Risks Have Shifted Rather Than Disappeared

Wiz Research has published an update to its GitHub Actions threat model, focusing on a long-running problem known as the "Pwn request". This is where a workflow trigger called pull_request_target runs with access to repository secrets, yet can be started by anyone who opens a pull request from a fork. In 2026, GitHub responded with platform changes, including checkout protections, read-only cache tokens and event policies, which make the default version of this attack significantly harder.

Wiz stresses that these changes shift the vulnerability class rather than eliminate it. Attackers who once targeted any pull_request_target workflow now need to find explicit opt-ins, outdated checkout versions, unprotected triggers or script injection. The December 2 enforcement is a default, not a ban. Maintainers whose automation depends on the trigger, such as labelers, preview deploys and fork CI with secrets, will add a policy allowing it. Those are exactly the workflows that handle untrusted input with elevated privileges. The default policy also does not cover private and internal repositories, or the workflow_run trigger.

One finding Wiz calls disconcerting is that a common supply chain hardening tip, pinning actions to exact commit SHAs, can inadvertently bypass GitHub's platform defenses. The post ends with an audit checklist for reviewing your own workflows. This summary draws on the opening of the article only, so read the full research for the detailed findings.