5-minute check: are GitHub tokens sitting in your AI agent logs?
24 October 2026
The LiteLLM breach started with GitHub CLI tokens found in logs. GitHub tokens carry readable prefixes (gho_ for OAuth, ghp_ for personal tokens, ghu_/ghs_ for apps, github_pat_ for fine-grained), so a quick grep -rE over your agent, proxy and CI logs finds them. Revoke any hit, then stop logging raw agent responses.
Based on reporting by GitHub Blog. Read their full coverage for details.