The secrets went out through GitHub's own API
A campaign on stolen GitHub tokens prints repository secrets into workflow logs and collects them through the API, so there is no address for a firm to block. A marketplace's ledger shows token use and token spend coming apart, and an engineer puts his agents' memory in files he can version.
How we Organise
Customers used eighteen times more tokens for five times the money
OpenRouter’s head of insights published the marketplace’s own figures on 22 October. Weekly volume went from about half a trillion tokens in January 2025 to 164 trillion in late September 2026. The average price paid per million tokens fell from 0.77 dollars to 0.14. Among customers spending at least 100 dollars a month a year ago, AI-native startups now use eighteen times the tokens for five times the spend. Software agents overtook people as the main source of tokens on 6 February and now account for about 131 trillion a week against 18 trillion.
A finance team reading a monthly token bill would see none of that. The bill would simply fall. We tell a client to record the cost of a release against the release:
Every customer release carries the token cost of producing it, recorded against the release rather than against the month.
A gateway reported the same divergence in July, on one month’s traffic. This is twenty-one months of it. The figures are one marketplace’s own. They are self-selected and carry no method section, and cheaper models may well lower spend per token whether or not anybody manages it.
How we Build
An engineer keeps his agents’ memory in files he can read and version
Andy Maguire at PostHog described how he works on 20 October. Over 28 days, 78 per cent of his 578 agent sessions loaded a skill file and 47 per cent wrote back to one. His main project file is on version 433 and carries 126 documents, among them 55 issues and 39 recorded failures, most written by agents at the end of a session because the file tells them to. A second holds the inventory of 178 production alerts. Anybody adding another consults it first. A third gains a dated write-up every time a new kind of failure is tracked down.
He declines to rely on the model’s own memory, which he cannot read. What he does instead is ordinary storage management: a convention for where each kind of fact goes, a retention rule, a handover overwritten rather than appended to, and a table the agent consults before it writes. Our position puts it in one line:
A system’s memory is a store like any other.
The figures are his own usage. His employer’s product measured them, and there is nobody who works differently to compare against.
How we Assure
The secrets went out through GitHub’s own API, so there was no address to block
Wiz Research has tracked a campaign since 15 September that runs on stolen GitHub tokens. For each repository it commits a workflow. That workflow prints the repository’s secrets into its own log, encoded so GitHub’s masking does not match them. The tool then collects the log through the API and deletes the run. Setting the job’s permissions to none restricts its token and leaves the secrets context untouched, and where a repository has deployment environments the job lists them, so production credentials print as well. Wiz has recovered more than 13,500 planted branches from more than 850 compromised accounts.
We ask two things of a client here. Declare where an agent runs, and put a named approver on every route out:
Agent execution runs inside a declared boundary that states what the platform does with the storage, memory and cache it has finished with, and every path out carries its approver.
Nothing here crossed a route out in that sense, because the secrets left through the platform the register itself describes. Two earlier sources argued the same way. A sandbox escape in August and a cross-tenant disk finding in September each sat on a boundary that passed every clause the test reads. GitHub’s own approval hold did stop every public run Wiz checked, and it does not cover private repositories or Enterprise Server. If you read a destination list as answering this, write and tell us why: transform@dromologue.ai