“Congress shall make no law re­spect­ing an es­tab­lish­ment of re­li­gion, or pro­hibit­ing the free ex­er­cise thereof; or abridg­ing the free­dom of speech, or of the press; or the right of the peo­ple peace­ably to as­sem­ble, and to pe­ti­tion the Government for a re­dress of griev­ances.” -U. S. Constitution, First Amendment.

In an ad­dress to Congress this month, President Trump claimed he had “brought free speech back to America.” But barely two months into his sec­ond term, the pres­i­dent has waged an un­prece­dented at­tack on the First Amendment rights of jour­nal­ists, stu­dents, uni­ver­si­ties, gov­ern­ment work­ers, lawyers and judges.

This story ex­plores a slew of re­cent ac­tions by the Trump ad­min­is­tra­tion that threaten to un­der­mine all five pil­lars of the First Amendment to the U. S. Constitution, which guar­an­tees free­doms con­cern­ing speech, re­li­gion, the me­dia, the right to as­sem­bly, and the right to pe­ti­tion the gov­ern­ment and seek re­dress for wrongs.

The right to pe­ti­tion al­lows cit­i­zens to com­mu­ni­cate with the gov­ern­ment, whether to com­plain, re­quest ac­tion, or share view­points — with­out fear of reprisal. But that right is be­ing as­saulted by this ad­min­is­tra­tion on mul­ti­ple lev­els. For starters, many GOP law­mak­ers are now heed­ing their lead­er­ship’s ad­vice to stay away from lo­cal town hall meet­ings and avoid the wrath of con­stituents af­fected by the ad­min­is­tra­tion’s many fed­eral bud­get and work­force cuts.

Another ex­am­ple: President Trump re­cently fired most of the peo­ple in­volved in pro­cess­ing Freedom of Information Act (FOIA) re­quests for gov­ern­ment agen­cies. FOIA is an in­dis­pens­able tool used by jour­nal­ists and the pub­lic to re­quest gov­ern­ment records, and to hold lead­ers ac­count­able.

The biggest story by far this week was the bomb­shell from The Atlantic ed­i­tor Jeffrey Goldberg, who re­counted how he was in­ad­ver­tently added to a Signal group chat with National Security Advisor Michael Waltz and 16 other Trump ad­min­is­tra­tion of­fi­cials dis­cussing plans for an up­com­ing at­tack on Yemen.

One over­looked as­pect of Goldberg’s in­cred­i­ble ac­count is that by plan­ning and co­or­di­nat­ing the at­tack on Signal — which fea­tures mes­sages that can auto-delete af­ter a short time — ad­min­is­tra­tion of­fi­cials were ev­i­dently seek­ing a way to avoid cre­at­ing a last­ing (and po­ten­tially FOIA-able) record of their de­lib­er­a­tions.

“Intentional or not, use of Signal in this con­text was an act of era­sure—be­cause with­out Jeffrey Goldberg be­ing ac­ci­den­tally added to the list, the gen­eral pub­lic would never have any record of these com­mu­ni­ca­tions or any way to know they even oc­curred,” Tony Bradley wrote this week at Forbes.

Petitioning the gov­ern­ment, par­tic­u­larly when it ig­nores your re­quests, of­ten re­quires chal­leng­ing fed­eral agen­cies in court. But that be­comes far more dif­fi­cult if the most com­pe­tent law firms start to shy away from cases that may in­volve cross­ing the pres­i­dent and his ad­min­is­tra­tion.

On March 22, the pres­i­dent is­sued a mem­o­ran­dum that di­rects heads of the Justice and Homeland Security Departments to “seek sanc­tions against at­tor­neys and law firms who en­gage in friv­o­lous, un­rea­son­able and vex­a­tious lit­i­ga­tion against the United States,” or in mat­ters that come be­fore fed­eral agen­cies.

The POTUS re­cently is­sued sev­eral ex­ec­u­tive or­ders rail­ing against spe­cific law firms with at­tor­neys who worked le­gal cases against him. On Friday, the pres­i­dent an­nounced that the law firm of Skadden, Arps, Slate, Meager & Flom had agreed to pro­vide $100 mil­lion in pro bono work on is­sues that he sup­ports.

Trump is­sued an­other or­der nam­ing the firm Paul, Weiss, Rifkind, Wharton & Garrison, which ul­ti­mately agreed to pledge $40 mil­lion in pro bono le­gal ser­vices to the pres­i­den­t’s causes.

Other Trump ex­ec­u­tive or­ders tar­geted law firms Jenner & Block and WilmerHale, both of which have at­tor­neys that worked with spe­cial coun­sel Robert Mueller on the in­ves­ti­ga­tion into Russian in­ter­fer­ence in the 2016 elec­tion. But this week, two fed­eral judges in sep­a­rate rul­ings froze parts of those or­ders.

“There is no doubt this re­tal­ia­tory ac­tion chills speech and le­gal ad­vo­cacy, and that is qual­i­fied as a con­sti­tu­tional harm,” wrote Judge Richard Leon, who ruled against the ex­ec­u­tive or­der tar­get­ing WilmerHale.

President Trump re­cently took the ex­tra­or­di­nary step of call­ing for the im­peach­ment of fed­eral judges who rule against the ad­min­is­tra­tion. Trump called U. S. District Judge James Boasberg a “Radical Left Lunatic” and urged he be re­moved from of­fice for block­ing de­por­ta­tion of Venezuelan al­leged gang mem­bers un­der a rarely in­voked wartime le­gal au­thor­ity.

In a rare pub­lic re­buke to a sit­ting pres­i­dent, U. S. Supreme Court Justice John Roberts is­sued a state­ment on March 18 point­ing out that “For more than two cen­turies, it has been es­tab­lished that im­peach­ment is not an ap­pro­pri­ate re­sponse to dis­agree­ment con­cern­ing a ju­di­cial de­ci­sion.”

The U. S. Constitution pro­vides that judges can be re­moved from of­fice only through im­peach­ment by the House of Representatives and con­vic­tion by the Senate. The Constitution also states that judges’ salaries can­not be re­duced while they are in of­fice.

Undeterred, House Speaker Mike Johnson this week sug­gested the ad­min­is­tra­tion could still use the power of its purse to keep courts in line, and even floated the idea of whole­sale elim­i­nat­ing fed­eral courts.

“We do have au­thor­ity over the fed­eral courts as you know,” Johnson said. “We can elim­i­nate an en­tire dis­trict court. We have power of fund­ing over the courts, and all these other things. But des­per­ate times call for des­per­ate mea­sures, and Congress is go­ing to act, so stay tuned for that.”

President Trump has taken a num­ber of ac­tions to dis­cour­age law­ful demon­stra­tions at uni­ver­si­ties and col­leges across the coun­try, threat­en­ing to cut fed­eral fund­ing for any col­lege that sup­ports protests he deems “illegal.”

A Trump ex­ec­u­tive or­der in January out­lined a broad fed­eral crack­down on what he called “the ex­plo­sion of an­ti­semitism” on U. S. col­lege cam­puses. This ad­min­is­tra­tion has as­serted that for­eign stu­dents who are law­fully in the United States on visas do not en­joy the same free speech or due process rights as cit­i­zens.

Reuters re­ports that the act­ing civil rights di­rec­tor at the Department of Education (DOE) on March 10 sent let­ters to 60 ed­u­ca­tional in­sti­tu­tions warn­ing they could lose fed­eral fund­ing if they don’t do more to com­bat anti-semi­tism. On March 20, Trump is­sued an or­der call­ing for the clo­sure of the DOE.

Meanwhile, U. S. Immigration and Customs Enforcement (ICE) agents have been de­tain­ing and try­ing to de­port pro-Pales­tin­ian stu­dents who are legally in the United States. The ad­min­is­tra­tion is tar­get­ing stu­dents and aca­d­e­mics who spoke out against Israel’s at­tacks on Gaza, or who were ac­tive in cam­pus protests against U.S. sup­port for the at­tacks. Secretary of State Marco Rubio told re­porters Thursday that at least 300 for­eign stu­dents have seen their visas re­voked un­der President Trump, a far higher num­ber than was pre­vi­ously known.

In his first term, Trump threat­ened to use the na­tional guard or the U. S. mil­i­tary to deal with pro­test­ers, and in cam­paign­ing for re-elec­tion he promised to re­visit the idea.

“I think the big­ger prob­lem is the en­emy from within,” Trump told Fox News in October 2024. “We have some very bad peo­ple. We have some sick peo­ple, rad­i­cal left lu­natics. And I think they’re the big — and it should be very eas­ily han­dled by, if nec­es­sary, by National Guard, or if re­ally nec­es­sary, by the mil­i­tary, be­cause they can’t let that hap­pen.”

This term, Trump acted swiftly to re­move the top ju­di­cial ad­vo­cates in the armed forces who would al­most cer­tainly push back on any re­quest by the pres­i­dent to use U. S. sol­diers in an ef­fort to quell pub­lic protests, or to ar­rest and de­tain im­mi­grants. In late February, the pres­i­dent and Defense Secretary Pete Hegseth fired the top le­gal of­fi­cers for the mil­i­tary ser­vices — those re­spon­si­ble for en­sur­ing the Uniform Code of Military Justice is fol­lowed by com­man­ders.

Military.com warns that the purge “sets an alarm­ing prece­dent for a cru­cial job in the mil­i­tary, as President Donald Trump has mused about us­ing the mil­i­tary in un­ortho­dox and po­ten­tially il­le­gal ways.” Hegseth told re­porters the re­movals were nec­es­sary be­cause he did­n’t want them to pose any “roadblocks to or­ders that are given by a com­man­der in chief.”

President Trump has sued a num­ber of U. S. news out­lets, in­clud­ing 60 Minutes, CNN, The Washington Post, The New York Times and other smaller me­dia or­ga­ni­za­tions for un­flat­ter­ing cov­er­age.

In a $10 bil­lion law­suit against 60 Minutes and its par­ent Paramount, Trump claims they se­lec­tively edited an in­ter­view with for­mer Vice President Kamala Harris prior to the 2024 elec­tion. The TV news show last month pub­lished tran­scripts of the in­ter­view at the heart of the dis­pute, but Paramount is re­port­edly con­sid­er­ing a set­tle­ment to avoid po­ten­tially dam­ag­ing its chances of win­ning the ad­min­is­tra­tion’s ap­proval for a pend­ing multi­bil­lion-dol­lar merger.

The pres­i­dent sued The Des Moines Register and its par­ent com­pany, Gannett, for pub­lish­ing a poll show­ing Trump trail­ing Harris in the 2024 pres­i­den­tial elec­tion in Iowa (a state that went for Trump). The POTUS also is su­ing the Pulitzer Prize board over 2018 awards given to The New York Times and The Washington Post for their cov­er­age of pur­ported Russian in­ter­fer­ence in the 2016 elec­tion.

Whether or not any of the pres­i­den­t’s law­suits against news or­ga­ni­za­tions have merit or suc­ceed is al­most be­side the point. The strat­egy be­hind su­ing the me­dia is to make re­porters and news­rooms think twice about crit­i­ciz­ing or chal­leng­ing the pres­i­dent and his ad­min­is­tra­tion. The pres­i­dent also knows some me­dia out­lets will find it more ex­pe­di­ent to set­tle.

Trump also sued ABC News and George Stephanopoulos for stat­ing that the pres­i­dent had been found li­able for “rape” in a civil case [Trump was found li­able of sex­u­ally abus­ing and de­fam­ing E. Jean Carroll]. ABC par­ent Disney set­tled that claim by agree­ing to do­nate $15 mil­lion to the Trump Presidential Library.

Following the at­tack on the U. S. Capitol on Jan. 6, 2021, Facebook blocked President Trump’s ac­count. Trump sued Meta, and af­ter the pres­i­den­t’s vic­tory in 2024 Meta set­tled and agreed to pay Trump $25 mil­lion: $22 mil­lion would go to his pres­i­den­tial li­brary, and the rest to le­gal fees. Meta CEO Mark Zuckerberg also an­nounced Facebook and Instagram would get rid of fact-check­ers and rely in­stead on reader-sub­mit­ted “community notes” to de­bunk dis­in­for­ma­tion on the so­cial me­dia plat­form.

Brendan Carr, the pres­i­den­t’s pick to run the Federal Communications Commission (FCC), has pledged to “dismantle the cen­sor­ship car­tel and re­store free speech rights for every­day Americans.” But on January 22, 2025, the FCC re­opened com­plaints against ABC, CBS and NBC over their cov­er­age of the 2024 elec­tion. The pre­vi­ous FCC chair had dis­missed the com­plaints as at­tacks on the First Amendment and an at­tempt to weaponize the agency for po­lit­i­cal pur­poses.

According to Reuters, the com­plaints call for an in­ves­ti­ga­tion into how ABC News mod­er­ated the pre-elec­tion TV de­bate be­tween Trump and Biden, and ap­pear­ances of then-Vice President Harris on 60 Minutes and on NBC’s “Saturday Night Live.”

Since then, the FCC has opened in­ves­ti­ga­tions into NPR and PBS, al­leg­ing that they are break­ing spon­sor­ship rules. The Center for Democracy & Technology (CDT), a think tank based in Washington, D. C., noted that the FCC is also in­ves­ti­gat­ing KCBS in San Francisco for re­port­ing on the lo­ca­tion of fed­eral im­mi­gra­tion au­thor­i­ties.

“Even if these in­ves­ti­ga­tions are ul­ti­mately closed with­out ac­tion, the mere fact of open­ing them — and the im­plicit threat to the news sta­tions’ li­cense to op­er­ate — can have the ef­fect of de­ter­ring the press from news cov­er­age that the Administration dis­likes,” the CDT’s Kate Ruane ob­served.

Trump has re­peat­edly threat­ened to “open up” li­bel laws, with the goal of mak­ing it eas­ier to sue me­dia or­ga­ni­za­tions for un­fa­vor­able cov­er­age. But this week, the U. S. Supreme Court de­clined to hear a chal­lenge brought by Trump donor and Las Vegas casino mag­nate Steve Wynn to over­turn the land­mark 1964 de­ci­sion in New York Times v. Sullivan, which in­su­lates the press from li­bel suits over good-faith crit­i­cism of pub­lic fig­ures.

The pres­i­dent also has in­sisted on pick­ing which re­porters and news out­lets should be al­lowed to cover White House events and par­tic­i­pate in the press pool that trails the pres­i­dent. He barred the Associated Press from the White House and Air Force One over their re­fusal to call the Gulf of Mexico by an­other name.

And the Defense Department has or­dered a num­ber of top me­dia out­lets to va­cate their spots at the Pentagon, in­clud­ing CNN, The Hill, The Washington Post, The New York Times, NBC News, Politico and National Public Radio.

“Incoming me­dia out­lets in­clude the New York Post, Breitbart, the Washington Examiner, the Free Press, the Daily Caller, Newsmax, the Huffington Post and One America News Network, most of whom are seen as con­ser­v­a­tive or fa­vor­ing Republican President Donald Trump,” Reuters re­ported.

Shortly af­ter Trump took of­fice again in January 2025, the ad­min­is­tra­tion be­gan cir­cu­lat­ing lists of hun­dreds of words that gov­ern­ment staff and agen­cies shall not use in their re­ports and com­mu­ni­ca­tions.

The Brookings Institution notes that in mov­ing to com­ply with this anti-speech di­rec­tive, fed­eral agen­cies have purged count­less tax­payer-funded data sets from a swathe of gov­ern­ment web­sites, in­clud­ing data on crime, sex­ual ori­en­ta­tion, gen­der, ed­u­ca­tion, cli­mate, and global de­vel­op­ment.

The New York Times re­ports that in the past two months, hun­dreds of ter­abytes of dig­i­tal re­sources an­a­lyz­ing data have been taken off gov­ern­ment web­sites.

“While in many cases the un­der­ly­ing data still ex­ists, the tools that make it pos­si­ble for the pub­lic and re­searchers to use that data have been re­moved,” The Times wrote.

On Jan. 27, Trump is­sued a memo (PDF) that paused all fed­er­ally funded pro­grams pend­ing a re­view of those pro­grams for align­ment with the ad­min­is­tra­tion’s pri­or­i­ties. Among those was en­sur­ing that no fund­ing goes to­ward ad­vanc­ing “Marxist eq­uity, trans­gen­derism, and green new deal so­cial en­gi­neer­ing poli­cies.”

According to the CDT, this or­der is a bla­tant at­tempt to force gov­ern­ment grantees to cease en­gag­ing in speech that the cur­rent ad­min­is­tra­tion dis­likes, in­clud­ing speech about the ben­e­fits of di­ver­sity, cli­mate change, and LGBTQ is­sues.

“The First Amendment does not per­mit the gov­ern­ment to dis­crim­i­nate against grantees be­cause it does not like some of the view­points they es­pouse,” the CDT’s Ruane wrote. “Indeed, those groups that are chal­leng­ing the con­sti­tu­tion­al­ity of the or­der ar­gued as much in their com­plaint, and have won an in­junc­tion block­ing its im­ple­men­ta­tion.”

On January 20, the same day Trump is­sued an ex­ec­u­tive or­der on free speech, the pres­i­dent also is­sued an ex­ec­u­tive or­der ti­tled “Reevaluating and Realigning United States Foreign Aid,” which froze fund­ing for pro­grams run by the U. S. Agency for International Development (USAID). Among those were pro­grams de­signed to em­power civil so­ci­ety and hu­man rights groups, jour­nal­ists and oth­ers re­spond­ing to dig­i­tal re­pres­sion and Internet shut­downs.

According to the Electronic Frontier Foundation (EFF), this in­cludes many free­dom tech­nolo­gies that use cryp­tog­ra­phy, fight cen­sor­ship, pro­tect free­dom of speech, pri­vacy and anonymity for mil­lions of peo­ple around the world.

“While the State Department has is­sued some lim­ited waivers, so far those waivers do not seem to cover the open source in­ter­net free­dom tech­nolo­gies,” the EFF wrote about the USAID dis­rup­tions. “As a re­sult, many of these pro­jects have to stop or se­verely cur­tail their work, lay off tal­ented work­ers, and stop or slow fur­ther de­vel­op­ment.”

On March 14, the pres­i­dent signed an­other ex­ec­u­tive or­der that ef­fec­tively gut­ted the U. S. Agency for Global Media (USAGM), which over­sees or funds me­dia out­lets in­clud­ing Radio Free Europe/Radio Liberty and Voice of America (VOA). The USAGM also over­sees Radio Free Asia, which sup­port­ers say has been one of the most re­li­able tools used by the gov­ern­ment to com­bat Chinese pro­pa­ganda.

But this week, U. S. District Court Judge Royce Lamberth, a Reagan ap­pointee, tem­porar­ily blocked USAGM’s clo­sure by the ad­min­is­tra­tion.

“RFE/RL has, for decades, op­er­ated as one of the or­ga­ni­za­tions that Congress has statu­to­rily des­ig­nated to carry out this pol­icy,” Lamberth wrote in a 10-page opin­ion. “The lead­er­ship of USAGM can­not, with one sen­tence of rea­son­ing of­fer­ing vir­tu­ally no ex­pla­na­tion, force RFE/RL to shut down — even if the President has told them to do so.”

The Trump ad­min­is­tra­tion re­scinded a decades-old pol­icy that in­structed of­fi­cers not to take im­mi­gra­tion en­force­ment ac­tions in or near “sensitive” or “protected” places, such as churches, schools, and hos­pi­tals.

That di­rec­tive was im­me­di­ately chal­lenged in a case brought by a group of Quakers, Baptists and Sikhs, who ar­gued the pol­icy re­ver­sal was keep­ing peo­ple from at­tend­ing ser­vices for fear of be­ing ar­rested on civil im­mi­gra­tion vi­o­la­tions. On Feb. 24, a fed­eral judge agreed and blocked ICE agents from en­ter­ing churches or tar­get­ing mi­grants nearby.

The pres­i­den­t’s ex­ec­u­tive or­der al­legedly ad­dress­ing an­ti­semitism came with a fact sheet that de­scribed col­lege cam­puses as “infested” with “terrorists” and “jihadists.” Multiple faith groups ex­pressed alarm over the or­der, say­ing it at­tempts to weaponize an­ti­semitism and pro­mote “dehumanizing anti-im­mi­grant poli­cies.”

The pres­i­dent also an­nounced the cre­ation of a “Task Force to Eradicate Anti-Christian Bias,” to be led by Attorney General Pam Bondi. Never mind that Christianity is eas­ily the largest faith in America and that Christians are well-rep­re­sented in Congress.

The Rev. Paul Brandeis Raushenbush, a Baptist min­is­ter and head of the pro­gres­sive Interfaith Alliance, is­sued a state­ment ac­cus­ing Trump of hypocrisy in claim­ing to cham­pion re­li­gion by cre­at­ing the task force.

“From al­low­ing im­mi­gra­tion raids in churches, to tar­get­ing faith-based char­i­ties, to sup­press­ing re­li­gious di­ver­sity, the Trump Administration’s ag­gres­sive gov­ern­ment over­reach is in­fring­ing on re­li­gious free­dom in a way we haven’t seen for gen­er­a­tions,” Raushenbush said.

A state­ment from Americans United for Separation of Church and State said the task force could lead to re­li­gious per­se­cu­tion of those with other faiths.

“Rather than pro­tect­ing re­li­gious be­liefs, this task force will mis­use re­li­gious free­dom to jus­tify big­otry, dis­crim­i­na­tion, and the sub­ver­sion of our civil rights laws,” said Rachel Laser, the group’s pres­i­dent and CEO.

Where is President Trump go­ing with all these bla­tant at­tacks on the First Amendment? The pres­i­dent has made no se­cret of his af­fec­tion for au­to­cratic lead­ers and “strongmen” around the world, and he is par­tic­u­larly en­am­ored with Hungary’s far-right Prime Minister Viktor Orbán, who has vis­ited Trump’s Mar-a-Lago re­sort twice in the past year.

A March 15 es­say in The Atlantic by Hungarian in­ves­tiga­tive jour­nal­ist András Pethő re­counts how Orbán rose to power by con­sol­i­dat­ing con­trol over the courts, and by build­ing his own me­dia uni­verse while si­mul­ta­ne­ously plac­ing a stran­gle­hold on the in­de­pen­dent press.

“As I watch from afar what’s hap­pen­ing to the free press in the United States dur­ing the first weeks of Trump’s sec­ond pres­i­dency — the ver­bal bul­ly­ing, the le­gal ha­rass­ment, the buck­ling by me­dia own­ers in the face of threats — it all looks very fa­mil­iar,” Pethő wrote. “The MAGA au­thor­i­ties have learned Orbán’s lessons well.”

A promi­nent com­puter sci­en­tist who has spent 20 years pub­lish­ing aca­d­e­mic pa­pers on cryp­tog­ra­phy, pri­vacy, and cy­ber­se­cu­rity has gone in­com­mu­ni­cado, had his pro­fes­sor pro­file, email ac­count, and phone num­ber re­moved by his em­ployer, Indiana University, and had his homes raided by the FBI. No one knows why.

Xiaofeng Wang has a long list of pres­ti­gious ti­tles. He was the as­so­ci­ate dean for re­search at Indiana University’s Luddy School of Informatics, Computing and Engineering, a fel­low at the Institute of Electrical and Electronics Engineers and the American Association for the Advancement of Science, and a tenured pro­fes­sor at Indiana University at Bloomington. According to his em­ployer, he has served as prin­ci­pal in­ves­ti­ga­tor on re­search pro­jects to­tal­ing nearly $23 mil­lion over his 21 years there.

He has also co-au­thored scores of aca­d­e­mic pa­pers on a di­verse range of re­search fields, in­clud­ing cryp­tog­ra­phy, sys­tems se­cu­rity, and data pri­vacy, in­clud­ing the pro­tec­tion of hu­man ge­nomic data. I have per­son­ally spo­ken to him on three oc­ca­sions for ar­ti­cles here, here, and here.

In re­cent weeks, Wang’s email ac­count, phone num­ber, and pro­file page at the Luddy School were qui­etly erased by his em­ployer. Over the same time, Indiana University also re­moved a pro­file for his wife, Nianli Ma, who was listed as a Lead Systems Analyst and Programmer at the uni­ver­si­ty’s Library Technologies di­vi­sion.

As re­ported by the Bloomingtonian and later the Herald-Times in Bloomington, a small fleet of un­marked cars dri­ven by gov­ern­ment agents de­scended on the Bloomington home of Wang and Ma on Friday. They spent most of the day go­ing in and out of the house and oc­ca­sion­ally trans­ferred boxes from their ve­hi­cles. TV sta­tion WTHR, mean­while, re­ported that a sec­ond home owned by Wang and Ma and lo­cated in Carmel, Indiana, was also searched. The sta­tion said that both a res­i­dent and an at­tor­ney for the res­i­dent were on scene dur­ing at least part of the search.

The demoscene has be­come a na­tional UNESCO-heritage in Sweden, thanks to an ap­pli­ca­tion that Ziphoid and me did last year. This has al­ready hap­pened in sev­eral European coun­tries, as part of the in­ter­na­tional Art of Coding ini­tia­tive to make the demoscene a global UNESCO her­itage. I think this makes plenty of sense, since the demoscene is ar­guably the old­est cre­ative dig­i­tal sub­cul­ture around. It has largely stuck to its own val­ues and tra­di­tions through­out the world’s tech­no­log­i­cal and eco­nom­i­cal shifts, and that sort of con­sis­tency is quite un­usual in the dig­i­tal world.

The main idea of the demoscene is to com­pete with pro­duc­tions that max­i­mize a cer­tain hard­ware, but that’s not what all demosceners like to do. My de­mogroup Hack n’ Trade for ex­am­ple, cares more about mak­ing weird stuff, and there are plenty of other groups like that. Some demosceners don’t re­lease any­thing at all, but might do im­por­tant work to keep the scene alive (BBS-trading, or­ga­niz­ing par­ties, pre­serv­ing soft­ware…).

I’ve writ­ten plenty of pa­pers and blog posts about the demoscene, and I’ve of­ten felt a gap be­tween the stuff I write as a re­searcher and my per­sonal ex­pe­ri­ence of the demoscene. There is cer­tainly an in­ter­na­tional demoscene with big events and huge re­leases that can be de­scribed in gen­eral terms, but what has mat­tered more to me is the lo­cal scenes, the small par­ties and the peo­ple you hang out with. Meeting up with a bunch of friends and mak­ing weird com­puter stuff “for no rea­son, re­ally” is a great set­ting. That’s what I en­joy the most, in the end. For other sceners, it’s dif­fer­ent.

There is a sort of di­ver­sity in the scene that is dif­fi­cult to cap­ture and gen­er­al­ize. The Swedish coder with a well-paid pro­gram­ming job and a busy fam­ily life might con­sider the demoscene as an es­cape to his teenage years, while the LSD-munching raver from France who trades il­le­gal warez on BBSs and makes weird pixel art con­sid­ers the scene as a free cul­ture with­out cor­po­rate or art world bull­shit. There’s room for both in the scene, be­cause it is werdly con­ser­v­a­tive and open at the same time. And per­haps that is one of the rea­sons why it should be con­sid­ered an in­tan­gi­ble her­itage.

Use this ser­vice to claim fi­nan­cial re­im­burse­ment for a tooth which has been lost and can­not be col­lected by the Tooth Fairy - for ex­am­ple, teeth which have been:

You can also print and fill in Form TF-230 and leave it un­der your pil­low.

Google just launched Gemini 2.5 Pro on March 26th, claim­ing to be the best in cod­ing, rea­son­ing and over­all every­thing. But I mostly care about how the model com­pares against the best avail­able cod­ing model, Claude 3.7 Sonnet (thinking), re­leased at the end of February, which I have been us­ing, and it has been a great ex­pe­ri­ence.

Let’s com­pare these two cod­ing mod­els and see if I need to change my favourite cod­ing model or if Claude 3.7 still holds.

If you want to jump straight to the con­clu­sion, I’d say go for Gemini 2.5 Pro, it’s bet­ter at cod­ing, has one mil­lion in con­text win­dow as com­pared to Claude’s 200k, and you can get it for free (a big plus). However, Claude’s 3.7 Sonnet is not that far be­hind. Though at this point there’s no point us­ing it over Gemini 2.5 Pro.

Just an ar­ti­cle ago, Claude 3.7 Sonnet was the de­fault an­swer to every model com­par­i­son, and this re­mained the same for quite some time. But here you go, Gemini 2.5 Pro takes the lead.

Gemini 2.5 Pro, an ex­per­i­men­tal think­ing model, be­came the talk of the town within a week of its re­lease. Everyone’s talk­ing about this model on Twitter (X) and YouTube. It’s trend­ing every­where, like se­ri­ously. The first model from Google to re­ceive such fan­fare.

And it is #1 in the LMArena just like that. But what does this mean? It means that this model is killing all the other mod­els in cod­ing, math, Science, Image un­der­stand­ing, and other ar­eas.

Gemini 2.5 pro comes with a 1 mil­lion to­ken con­text win­dow, with a 2 mil­lion con­text win­dow com­ing soon. 🤯

You can check out other folks like Theo-t3 talk­ing about this model to get a bit more in­sight into it:

It is the best cod­ing model to date, with an ac­cu­racy of about 63.8% on the SWE bench. This is def­i­nitely higher than our pre­vi­ous top cod­ing model, Claude 3.7 Sonnet, which had an ac­cu­racy of about 62.3%.

This is a quick demo Google shared on this model of build­ing a di­nosaur game.

Here’s a quick bench­mark of this model on Reasoning, Mathematics, and Science. This con­firms that the model is not just suit­able for cod­ing but also for all your other needs. They claim it’s an all-rounder. 🤷‍♂️

This is all cool, and I’ll con­firm the claim, but in this ar­ti­cle, I will mainly be com­par­ing the model on cod­ing, and let’s see how well it per­forms com­pared to Claude 3.7 Sonnet.

Let’s com­pare these two mod­els in cod­ing. We’ll do a to­tal of 4 tests, mainly on WebDev, an­i­ma­tion and a tricky LeetCode ques­tion.

Prompt: Create a sim­ple flight sim­u­la­tor us­ing JavaScript. The sim­u­la­tor should fea­ture a ba­sic plane that can take off from a flat run­way. The plane’s move­ment should be con­trolled with sim­ple key­board in­puts (e.g., ar­row keys or WASD). Additionally, it gen­er­ates a ba­sic cityscape us­ing blocky struc­tures, sim­i­lar to Minecraft.

You can find the code it gen­er­ated here: Link

Here’s the out­put of the pro­gram:

I def­i­nitely got ex­actly what I asked for, with every­thing func­tion­ing, from plane move­ments to the ba­sic Minecraft-styled block build­ings. I can’t re­ally com­plain about any­thing here. 10/10 for this one.

You can find the code it gen­er­ated here: Link

Here’s the out­put of the pro­gram:

I can see some is­sues with this one. The plane clearly faces side­ways, and I don’t know why. Again, it was out of con­trol once it took off and went clearly out­side the city. Basically, I’d say we did­n’t re­ally get a com­pletely work­ing flight sim­u­la­tor here.

It’s fair to say that Gemini 2.5 re­ally got this cor­rect in one shot. But the is­sues with the Claude 3.7 Sonnet code aren’t re­ally that big to re­solve. Yeah, we did­n’t re­ally get the out­put as ex­pected, and it’s def­i­nitely not close to what Gemini 2.5 Pro got us.

This is one of the tough­est ques­tions for LLMs. I’ve tried it with many other LLMs, but none could cor­rect it. Let’s see how these two mod­els do this one.

Prompt: Build a sim­ple 3D Rubik’s Cube vi­su­al­izer and solver in JavaScript us­ing Three.js. The cube should be a 3×3 Rubik’s Cube with stan­dard colours. Have a scram­ble but­ton that ran­domly scram­bles the cube. Include a solve func­tion that an­i­mates the so­lu­tion step by step. Allow ba­sic mouse con­trols to ro­tate the view.

You can find the code it gen­er­ated here: Link

Here’s the out­put of the pro­gram:

It’s im­pres­sive that it could do some­thing this hard in one shot. With the 1 mil­lion to­ken con­text win­dow, I can truly see how pow­er­ful this model seems to be.

You can find the code it gen­er­ated here: Link

Here’s the out­put of the pro­gram:

Again, I was kind of dis­ap­pointed that it had the same is­sue as some other LLMs: fail­ing with the colours and com­pletely fail­ing to solve the cube. I did try to help it come up with the an­swer, but it did­n’t re­ally help.

Here again, Gemini 2.5 Pro takes the lead. And the best part is that all of it was done in one shot. Claude 3.7 was re­ally dis­ap­point­ing, as it could not get this one cor­rect, de­spite be­ing one of the finest cod­ing mod­els out there.

Prompt: Create a sim­ple JavaScript script that vi­su­al­izes a ball bounc­ing in­side a ro­tat­ing 4D tesser­act. When the ball col­lides with a side, high­light that side to in­di­cate the im­pact.

You can find the code it gen­er­ated here: Link

Here’s the out­put of the pro­gram:

I can­not no­tice a sin­gle is­sue in the out­put. The ball and the col­li­sion physics all work per­fectly, even the part where I asked it to high­light the col­li­sion side works. This free model seems to be in­sane for cod­ing. 🔥

You can find the code it gen­er­ated here: Link

Here’s the out­put of the pro­gram:

Wow, fi­nally, Claude 3.7 Sonnet got an an­swer cor­rect. It also added col­ors to each side, but who asked for it? 🤷‍♂️ Nevertheless, I can’t re­ally com­plain much here, as the main func­tion­al­ity seems to work just fine.

The an­swer is ev­i­dent this time. Both mod­els got the an­swer cor­rect, im­ple­ment­ing every­thing I asked for. I won’t re­ally say that I like the out­put of Claude 3.7 Sonnet more, but it def­i­nitely put in quite some work com­pared to Gemini 2.5 Pro.

For this one, let’s do a quick LeetCode check with to see how these mod­els han­dle solv­ing a tricky LeetCode ques­tion with an ac­cep­tance rate of just 14.9%: Maximum Value Sum by Placing 3 Rooks.

Claude 3.7 Sonnet is known to be su­per good at solv­ing LC ques­tions. If you want to see how Claude 3.7 com­pares to some top mod­els like Grok 3 and o3-mini-high, check out this blog post:

Given how eas­ily it an­swered all three of the cod­ing ques­tions we tested, I have quite high hopes for this model.

You can find the code it gen­er­ated here: Link

It did take quite some time to an­swer this one, though, and the code it wrote is kind of su­per com­plex to make sense of. I think it an­swered it more com­pli­cated than re­quired. But still, the main thing we’re look­ing for is to see if it can an­swer it cor­rectly.

As ex­pected, it also an­swered this tough LeetCode ques­tion in one shot. This is one of the ques­tions I got stuck on when learn­ing DSA. I’m not sure if I’m happy it did.

I hope this model will crush this one, as in all the other cod­ing tests I’ve done, Claude 3.7 Sonnet has an­swered all of the LeetCode ques­tions cor­rectly.

You can find the code it gen­er­ated here: Link

It did write cor­rect code but got TLE, but if I have to com­pare the code’s sim­plic­ity, I’d say this model made the code sim­pler and eas­ier to un­der­stand.

Gemini 2.5 got the an­swer cor­rect and also wrote the code in the ex­pected time com­plex­ity, but Claude 3.7 Sonnet fell into TLE. If I have to com­pare the code sim­plic­ity, Claude 3.7’s gen­er­ated code seems to be bet­ter.

For me, Gemini 2.5 Pro is the win­ner. We’ve com­pared two mod­els that are said to be the best at cod­ing. The big dif­fer­ence I see in the model stats is just that Gemini 2.5 Pro has a slightly higher con­text win­dow, but let’s not for­get that this is an ex­per­i­men­tal model, and im­prove­ments are still on the way.

Google’s been killing it re­cently with such solid mod­els, pre­vi­ously with the Gemma 3 27B model, a su­per light­weight model with un­be­liev­able re­sults, and now with this beast of a model, Gemini 2.5 Pro.

By the way, if you are here, Composio is build­ing the skill repos­i­tory for agents. You can con­nect LLMs to any ap­pli­ca­tion from Gmail to Asana and get things done quickly. You can use MCP servers, or di­rectly add the tools to LLMs in the tra­di­tional agen­tic way.

An emer­gency sit­u­a­tion that turned out to be mostly a false alarm led a lot of schools in Los Angeles to in­stall air fil­ters, and some­thing strange hap­pened: Test scores went up. By a lot. And the gains were sus­tained in the sub­se­quent year rather than fad­ing away.

The im­pact of the air fil­ters is strik­ingly large given what a sim­ple change we’re talk­ing about. The school dis­trict did­n’t reengi­neer the school build­ings or make dra­matic ed­u­ca­tion re­forms; they just in­stalled $700 com­mer­cially avail­able fil­ters that you could plug into any room in the coun­try. But it’s con­sis­tent with a grow­ing lit­er­a­ture on the cog­ni­tive im­pact of air pol­lu­tion, which finds that every­one from chess play­ers to base­ball um­pires to work­ers in a pear-pack­ing fac­tory suf­fer de­te­ri­o­ra­tions in per­for­mance when the air is more pol­luted.

And while it’s too hasty to draw sweep­ing con­clu­sions on the ba­sis of one study, it would be in­cred­i­bly cheap to have a few cities ex­per­i­ment with in­stalling air fil­ters in some of their schools to get more data and draw clearer con­clu­sions about ex­actly how much of a dif­fer­ence this makes.

Strikingly, how­ever, air test­ing con­ducted around the time of the in­stal­la­tion of the fil­ters shows that the schools did­n’t ac­tu­ally have ab­nor­mally high lev­els of the kinds of pol­lu­tion that are nor­mally as­so­ci­ated with nat­ural gas. Methane is lighter than air, and by the time the fil­ters were in­stalled — nearly three months af­ter the leak — the ex­tra pol­lu­tion caused was all the way up in the sky and not af­fect­ing school build­ings.

Consequently, the in­stal­la­tion of the fil­ters served not to re­move ex­tra con­t­a­m­i­na­tion caused by the leak, but sim­ply to clean up the nor­mal amount of back­ground in­door air pol­lu­tion pre­sent in the Valley. That lets Gilraine es­ti­mate the dif­fer­ence in stu­dent per­for­mance for schools just in­side the bound­ary com­pared to those just out­side.

For con­text, this is com­pa­ra­ble in scale to some of the most op­ti­mistic stud­ies on the po­ten­tial ben­e­fits of smaller class sizes, with Alan Krueger find­ing that cut­ting class size by a third leads to a 0.22 stan­dard de­vi­a­tion im­prove­ment in aca­d­e­mic per­for­mance. Other stud­ies find smaller or even neg­a­tive ef­fects (because adding teach­ers means bring­ing in less ex­pe­ri­enced or less ef­fec­tive ones), but even ac­cept­ing the pos­i­tive find­ings, it costs much more than $700 per class­room to achieve class size re­duc­tions of that scale.

But Sefi Roth of the London School of Economics stud­ied uni­ver­sity stu­dents’ test per­for­mance rel­a­tive to air pol­lu­tion lev­els on the day of the test alone. He found that tak­ing a test in a fil­tered rather than un­fil­tered room would raise test scores by 0.09 stan­dard de­vi­a­tions. That’s about half the im­pact Gilraine found, just based on day-of-test air qual­ity. In Gilraine’s nat­ural ex­per­i­ment, stu­dents ben­e­fited from cleaner air for about four months. Given that con­text, it’s not in­cred­i­bly sur­pris­ing that you could see an im­pact that’s about twice as large.

What’s nat­ural to ask — though un­know­able from the study be­fore us — is how much more change we could see if stu­dents ben­e­fited from an en­tire school year of clean air. Or per­haps an en­tire school ca­reer, from pre-K through high school grad­u­a­tion, of clean air.

One strik­ing thing about this is the gov­ern­ment has long been aware that in­door air pol­lu­tion is a po­ten­tial prob­lem. But ac­cord­ing to cur­rently pre­vail­ing Indoor Air Quality stan­dards, there was noth­ing wrong with the air in the schools. Filters were in­stalled be­cause of an es­sen­tially un­war­ranted panic about nat­ural gas.

And while Los Angeles is a fairly high-pol­lu­tion part of the coun­try, out­door par­tic­u­late lev­els are higher in many ar­eas — in­clud­ing New York, Chicago, and Houston — than they were in the im­pacted neigh­bor­hood. In other words, there’s no rea­son to think the im­pacted schools were un­usu­ally de­fi­cient in their air qual­ity. They just hap­pen to be the ones that in­stalled fil­ters.

For a sense of scale, Mathematica Policy Research’s best ev­i­dence on the ef­fec­tive­ness of the highly touted KIPP char­ter school net­work finds that af­ter three years at KIPP there is sig­nif­i­cant im­prove­ment on three out of four test met­rics — up 0.25 stan­dard de­vi­a­tions on one English test, 0.22 stan­dard de­vi­a­tions on an­other, and 0.28 stan­dard de­vi­a­tions on one of two math tests.

This is big­ger than the im­pact of let­ting kids ben­e­fit from clean air for four months. But in­stalling the full suite of air fil­ters costs about $1,000 per class­room, and con­tin­u­ing to op­er­ate them be­yond the first year is cheaper than that. And best of all, un­like to­tally re­work­ing school op­er­a­tions, it could be scaled up very quickly.

It would be al­most triv­ially easy to get a va­ri­ety of school dis­tricts all around the coun­try to ran­domly se­lect schools for the in­stal­la­tion of air fil­ters. That would rapidly gen­er­ate a ton of ad­di­tional data, and if the re­sults con­tin­ued to be promis­ing, the ini­tia­tive could be made uni­ver­sal very quickly.

The ben­e­fits, on their face, would be ex­tremely large at a rel­a­tively low cost. And since air pol­lu­tion is gen­er­ally worse in lower-in­come com­mu­ni­ties, you would not only raise test scores na­tion­ally, but make progress on the big so­cioe­co­nomic gaps in stu­dent achieve­ment that have proven very dif­fi­cult to rem­edy.

A po­ten­tial sup­ply chain at­tack on GitHub CodeQL started sim­ply: a pub­licly ex­posed se­cret, valid for 1.022 sec­onds at a time.

In that sec­ond, an at­tacker could take a se­ries of steps that would al­low them to ex­e­cute code within a GitHub Actions work­flow in most repos­i­to­ries us­ing CodeQL, GitHub’s code analy­sis en­gine trusted by hun­dreds of thou­sands of repos­i­to­ries. The im­pact would reach both pub­lic GitHub (GitHub Cloud) and GitHub Enterprise.

If back­door­ing GitHub Actions sounds fa­mil­iar, that’s be­cause it’s ex­actly what threat ac­tors did in the re­cent tj-ac­tions/​changed-files sup­ply chain at­tack. Imagine that very same sup­ply chain at­tack, but in­stead of back­door­ing ac­tions in tj-ac­tions, they back­doored ac­tions in GitHub CodeQL.

An at­tacker could use this to:

Compromise in­tel­lec­tual prop­erty by ex­fil­trat­ing the source code of pri­vate repos­i­to­ries us­ing CodeQL.

Steal cre­den­tials within GitHub Actions se­crets of work­flow jobs us­ing CodeQL and lever­age those se­crets to ex­e­cute fur­ther sup­ply chain at­tacks.

Compromise GitHub Actions se­crets of work­flows us­ing the GitHub Actions Cache within a repo that uses CodeQL.

This is the story of how we un­cov­ered an ex­posed se­cret lead­ing to a race con­di­tion, a po­ten­tial sup­ply chain at­tack, and CVE-2025-24362.

Note: Per GitHub’s ad­vi­sory, they have found no ev­i­dence of com­pro­mise to its plat­form or sys­tems.

In January 2025, I took a break from Praetorian’s Red Team and be­gan three months of re­search. I aimed to push the lim­its of pub­lic GitHub Actions ex­ploita­tion, build­ing on pre­sen­ta­tions we’ve given at Black Hat, DEF CON, Schmoocon, and Black Hat Arsenal. Tools and take­aways from this re­search will be im­ple­mented in our CI/CD Professional Services Engagements, and into Chariot, our Continuous Threat Exposure Management plat­form.

I be­gan my re­search ro­ta­tion by scan­ning GitHub Actions work­flow ar­ti­facts for se­crets.

In August 2024, Palo Alto re­searcher Yaron Avital pub­lished an ar­ti­cle about iden­ti­fy­ing se­crets in work­flow ar­ti­facts. I had a hunch that there were still se­crets to be found, es­pe­cially since there had­n’t been much pub­lic fol­low-up work since the ar­ti­cle.

I built a sim­ple Actions Artifacts Secret Scanner to get started. It down­loads ar­ti­facts from GitHub Actions work­flows, re­cur­sively ex­tracts their con­tents, and scans their con­tents for se­crets with Nosey Parker, Praetorian’s open-sourced se­crets scan­ning tool.

The Actions Artifacts Secret Scanner has been in­te­grated into Chariot and open-sourced as a Gato ca­pa­bil­ity.

After run­ning this scan­ner for one day, it found a se­cret that could lead to a sup­ply chain at­tack on GitHub CodeQL.

But first, I needed to see if the key was us­able.

CI/CD vul­ner­a­bil­i­ties sound com­pli­cated un­til you un­der­stand the ter­mi­nol­ogy. Let’s catch you up.

GitHub Actions is a con­tin­u­ous in­te­gra­tion and con­tin­u­ous de­liv­ery (CI/CD) plat­form that al­lows the ex­e­cu­tion of code spec­i­fied within work­flows as part of the CI/CD process. When you push code to a GitHub repos­i­tory or cre­ate a pull re­quest, GitHub Actions can au­to­mat­i­cally build, test, and de­ploy your code us­ing work­flows de­fined in YAML files.

For ex­am­ple, let’s say you are build­ing a web ap­pli­ca­tion that is hosted in AWS. You can con­fig­ure a GitHub Actions work­flow so that when­ever you push code to your repos­i­tory, it is au­to­mat­i­cally tested and then de­ployed to AWS.

If you are new to GitHub Actions, we’d rec­om­mend read­ing through some ex­am­ples.

Every work­flow run gen­er­ates a GITHUB_TOKEN — a spe­cial, au­to­mat­i­cally gen­er­ated GitHub App in­stal­la­tion to­ken that al­lows the work­flow to in­ter­act with the repos­i­tory. This to­ken’s per­mis­sions can be con­fig­ured in the work­flow file, at the repos­i­tory level, or at the org level, de­ter­min­ing what ac­tions it can per­form within the repos­i­tory.

* GitHub run­ners need a way to au­then­ti­cate to GitHub to do stuff the work­flows tell them to do.

* For that pur­pose, they use the GITHUB_TOKEN.

If the to­ken has high priv­i­leges, then to­ken com­pro­mise == bad.

We found the pub­licly ex­posed se­cret in a GitHub Actions work­flow ar­ti­fact.

GitHub Actions work­flows can up­load work­flow “artifacts” to GitHub Actions. Workflow ar­ti­facts can be any file and are saved by that work­flow for later use. By de­fault, ar­ti­facts are pub­licly ac­ces­si­ble to any­one with read ac­cess to the repos­i­tory and are stored for up to 90 days.

CodeQL is GitHub’s Code Analysis Engine. The CodeQL ac­tions per­form sta­tic code analy­sis on GitHub repos­i­to­ries to try and iden­tify vul­ner­a­bil­i­ties. They have found sev­eral hun­dred CVEs over it’s life­time, pro­tect­ing or­ga­ni­za­tions from breaches.

Security tools, like CodeQL, of­ten need ac­cess to sen­si­tive sys­tems and data, mak­ing them an at­trac­tive tar­get to an at­tacker.

If CodeQL was com­pro­mised, one of the most widely used se­cu­rity tools now be­comes a back­door.

After run­ning the Actions Artifact Secrets Scanner for a day, it picked up a to­ken in a github/​cod­eql-ac­tion repos­i­tory ar­ti­fact pub­lished by this run. The Actions Artifact Secrets Scanner down­loaded the “my-debug-artifacts” zip up­loaded by the “PR Check — Debug ar­ti­facts af­ter fail­ure” work­flow, re­cur­sively ex­tracted the “my-db-java-partial.zip” file stored in­side, and ran Nosey Parker. Within sec­onds, Nosey Parker flagged a GitHub Token start­ing with “ghs_” in a crash re­port.

Investigating man­u­ally, I con­firmed this was a GitHub App to­ken in­stal­la­tion to­ken stored in a file con­tain­ing the en­vi­ron­ment vari­ables of the GitHub Runner ex­e­cut­ing the work­flow.

Secrets com­pro­mise is cool, but what can we do with this to­ken? The im­pact of a com­pro­mised

GITHUB_TOKEN is min­i­mal if it only has read per­mis­sions.

The eas­i­est way to de­ter­mine the priv­i­leges of a GITHUB_TOKEN is to look at work­flow logs. To in­ves­ti­gate this, I nav­i­gated to the “Setup Job” step of the work­flow that up­loaded the to­ken.

We could spend a lot of time talk­ing about each priv­i­lege, but let’s fo­cus on the ones that are par­tic­u­larly in­ter­est­ing.

Contents: write — Allows the to­ken to cre­ate branches, cre­ate tags, and up­load re­lease ar­ti­facts.

Actions: write — Allows you to work with Actions, in­clud­ing trig­ger work­flow_dis­patch events.

Packages: write — Allows the to­ken to up­load pack­ages.

With these priv­i­leges, an at­tacker has a lot of po­ten­tial for repos­i­tory tam­per­ing, but there is still one is­sue. These to­kens are only valid for the du­ra­tion of their spe­cific work­flow job. That means that once the job is over, the to­ken is use­less. Three things needed to hap­pen for an at­tacker to be able to abuse this to­ken:

The to­ken needs to have some sort of write priv­i­leges (already con­firmed).

The to­ken needs to use V4 of the up­load ar­ti­fact API, as that is the only ver­sion that al­lows you to re­trieve an ar­ti­fact be­fore the job is com­plete (and af­ter the job is com­plete, the to­ken is in­valid.)

The time be­tween up­load­ing the ar­ti­fact and com­plet­ing the job needs to be great enough for us to down­load, ex­tract, and use the to­ken.

If all of these con­di­tions are met, this pub­licly ex­posed to­ken could be used to launch a full scale sup­ply chain at­tack on CodeQL. This was like find­ing out that the se­cu­rity guard was ac­ci­den­tally leav­ing their mas­ter key in plain sight for a brief mo­ment, over and over again.

We had to de­ter­mine if the guard left us enough time to steal the key and use it be­fore they re­turned to their post.

Identifying the ar­ti­fact up­load ver­sion is typ­i­cally straight­for­ward. If a work­flow uses

ac­tions/​up­load-ar­ti­fact@v4***, we can re­trieve the ar­ti­fact be­fore job com­ple­tion. If it uses an ear­lier ver­sion, we can­not do so.

In this case, CodeQL was­n’t us­ing the ac­tions/​up­load-ar­ti­fact ac­tion; they were man­u­ally us­ing the up­load ar­ti­fact client in the source code. Code com­ments in­di­cated it used ver­sion 4. That was enough for me to con­tinue.

Now we needed to de­ter­mine if the job lasted long enough for us to re­trieve and use the to­ken.

Looking at the raw GitHub logs for this work­flow, we can see two key time­stamps:

The fi­nal step in the job, “Cleaning up or­phan processes”, hap­pened at 17:22:10:911.

That means we had ap­prox­i­mately 1.022 sec­onds to down­load the ar­ti­fact, ex­tract the GitHub to­ken, and use it. I no­ticed the to­ken stayed valid for about a sec­ond af­ter the “Cleaning up or­phan processes” step, so we’ll call it two sec­onds.

The guard was giv­ing us two sec­onds to steal the key and use it be­fore they re­turned.

Is that enough time for an at­tacker to use this to­ken? Or is this an­other the­o­ret­i­cal vul­ner­a­bil­ity?

To test this, I made a Python script ar­ti­fac­t_racer.py. Artifact racer per­forms the fol­low­ing ac­tions.

Continuously queries the github/​cod­eql-ac­tion GitHub repos­i­tory un­til it sees a “PR Check — Debug ar­ti­facts af­ter fail­ure” work­flow be­gin.

Once it sees a “PR Check — Debug ar­ti­facts af­ter fail­ure” work­flow run, it down­loads the ar­ti­fact and ex­tracts the GITHUB_TOKEN.

Shelling out for file op­er­a­tions and down­loads was key to in­creas­ing the speed, al­though there are prob­a­bly ways to make it even faster.

Uses the GITHUB_TOKEN to make a new branch.

Use the GITHUB_TOKEN to push an empty file named poc.txt to that branch.

Makes a new tag for that com­mit.

If I could make a new branch, add a file, and cre­ate a tag for that com­mit, that would prove an at­tacker could use the to­ken for ne­far­i­ous pur­poses be­fore it ex­pired.

Given that the work­flow ar­ti­fact was only ~21MBs, I thought we had a chance. After suc­cess­fully ex­e­cut­ing against a test repos­i­tory, I moved on to the github/​cod­eql-ac­tion repos­i­tory.

About two hours later, a “PR Check — Debug ar­ti­facts af­ter fail­ure” work­flow ex­e­cuted. The racer suc­cess­fully re­trieved the GITHUB_TOKEN, cre­ated the branch, pushed the file, and added the tag.

The abil­ity to cre­ate a tag be­comes very im­por­tant in this at­tack. Keep that in mind as we go.

After con­firm­ing the GITHUB_TOKEN could be used within the short time win­dow, we re­spon­si­bly dis­closed this vul­ner­a­bil­ity to GitHub.

Using the GITHUB_TOKEN, an at­tacker could add ma­li­cious code to any un­pro­tected branch. A covert tac­tic would be to tar­get fea­ture branches pre-merge, smug­gle in a small ma­li­cious code change, and wait for it to get merged. This would be es­pe­cially ef­fec­tive due to how fre­quently the GitHub Actions bot com­mits to the CodeQL Actions repos­i­tory.

They could also add tags that point to spe­cific com­mits. For ex­am­ple, if they had ma­li­cious code on a branch and then added a v3 tag, any­one who man­u­ally used cod­eql-ac­tion…@v3 would ex­e­cute the ma­li­cious code. More on this later.

Through code ex­e­cu­tion, you’d be able to com­pro­mise any GitHub Actions se­cret used within that job, as well as ex­fil­trate the source code of that repos­i­tory. If their ac­tions were ex­e­cut­ing on in­ter­nal in­fra­struc­ture, which is com­mon with self-hosted GitHub run­ners, you’d also have code ex­e­cu­tion on their in­ter­nal net­work or cloud en­vi­ron­ment.

The im­pact from this at­tack would have been very sim­i­lar to the re­cent tj-ac­tions/​changed-files sup­ply chain at­tack.

This im­pact is im­pres­sive, but it does­n’t quite live up to the claims I made in the be­gin­ning. Yes, through these paths, they could launch a sup­ply chain at­tack against re­pos man­u­ally us­ing the CodeQL ac­tions. However, most or­ga­ni­za­tions don’t in­clude these ac­tions man­u­ally. They just go into their repos­i­tory set­tings, click “Enable CodeQL”, and go from there.

At first, I as­sumed that en­abling CodeQL in your repos­i­tory did­n’t in­ter­act with the github/​cod­eql-ac­tion repos­i­tory at all.

After dis­cussing this is­sue with some col­leagues, I de­cided to in­ves­ti­gate fur­ther. What ac­tu­ally hap­pens when you en­able CodeQL?

This sec­tion is key to un­der­stand­ing the full im­pact of this vul­ner­a­bil­ity. Stick with me.

To in­ves­ti­gate, I cre­ated my own pub­lic repos­i­tory, “John’s Top Secret Repo”, and en­abled CodeQL.

After you en­able CodeQL with the de­fault set­tings, a spe­cial GitHub Actions work­flow runs in your repos­i­tory. This CodeQL ac­tion won’t show up in your repos­i­tory work­flows, but you can nav­i­gate to the work­flow logs to see what it is do­ing.

Checks out your repos­i­tory to the filesys­tem

Let’s take a closer look at step 3.

If this does­n’t shock you, look again. Remember that we have the abil­ity to push tags to the github/​cod­eql-ac­tion repos­i­tory.

CodeQL, un­der the hood, is ex­e­cut­ing the ac­tions in the github/​cod­eql-ac­tion repos­i­tory, us­ing the com­mit ref­er­enced by the v3 tag. This tag was not im­mutable, and they were not us­ing work­flow pin­ning (which GitHub rec­om­mends), which meant that an at­tacker could over­write the v3 tag us­ing the com­pro­mised GITHUB_TOKEN. Now, if an at­tacker re­moved and then added a v3 tag to their ma­li­cious com­mit, every sin­gle repos­i­tory us­ing the de­fault CodeQL work­flow would ex­e­cute their ma­li­cious code.

The Action cre­ated when se­lect­ing “Advanced CodeQL” also used the reusable github/​cod­eql-ac­tion with the v3 tag.

The CodeQL ac­tions check out the source code of every repos­i­tory they run on, which means that a ma­li­cious CodeQL ac­tion could ex­fil­trate the source code of any repos­i­tory us­ing de­fault CodeQL con­fig­u­ra­tions.

This would re­sult in sig­nif­i­cant dis­clo­sure of in­tel­lec­tual prop­erty. And if you’ve ever op­er­ated on a Red Team, you know how many hard­coded se­crets are ly­ing around in pri­vate source code repos­i­to­ries.

We’re al­most done. But re­mem­ber, I promised one more thing:

4. Compromise GitHub Actions se­crets of any work­flow us­ing the GitHub Actions Cache within a repo that uses CodeQL

When as­sess­ing the im­pact of CI/CD at­tack paths, I look for ways to com­pro­mise GitHub Actions se­crets. Usually, those se­crets are where the crown jew­els live.

If the CodeQL ac­tion is ex­e­cut­ing with write priv­i­leges or along­side GitHub Actions se­crets, then it’s triv­ial to use the code ex­e­cu­tion to ex­fil­trate those se­crets. But the de­fault CodeQL ac­tion uses a GITHUB_TOKEN that only has read priv­i­leges, so you can’t per­form repos­i­tory write op­er­a­tions, back­door re­leases, or use fancy work­flow dis­patch events to steal se­crets, like what hap­pened with PyTorch.

What the de­fault CodeQL ac­tion does do is ex­e­cute in the main branch of the repos­i­tory. The main branch of any GitHub repos­i­tory can write cache en­tries that will be used by the en­tire repo. This opens up an op­por­tu­nity to con­duct GitHub Actions cache poi­son­ing.

GitHub Actions Cache Poisoning is thor­oughly ex­plained in this ar­ti­cle by Adnan Khan, which doc­u­ments the dis­cov­ery and ex­ploita­tion of cache poi­son­ing. The eas­i­est way to con­duct GitHub Actions cache poi­son­ing is by de­ploy­ing Cacheract, mal­ware that per­sists in a build pipeline through cache poi­son­ing.

If an at­tacker de­ployed Cacheract in the CodeQL work­flow, it would:

Gain code ex­e­cu­tion within any work­flow that uses ac­tion-cache (the Actions Cache is used by most repos­i­to­ries)

Leverage code ex­e­cu­tion to com­pro­mise GitHub Actions se­crets used by those work­flows, cap­ture priv­i­leged GITHUB_TOKENs, and more

Even if some­one no­ticed the ma­li­cious CodeQL ac­tion and re­me­di­ated the vul­ner­a­bil­ity, Cacheract would con­tinue poi­son­ing caches.

I spent ten min­utes look­ing for promi­nent re­pos that use CodeQL & ac­tions/​cache and iden­ti­fied

Homebrew, Angular, and Grafana.

Cache poi­son­ing would al­low an at­tacker to lever­age this CodeQL sup­ply chain at­tack to gain write ac­cess to repos­i­to­ries and repos­i­tory se­crets.

We’ve now hit all the im­pact high­lights I men­tioned at the be­gin­ning:

Compromise in­tel­lec­tual prop­erty by ex­fil­trat­ing the source code of all pri­vate repos­i­to­ries us­ing CodeQL.

Steal cre­den­tials within GitHub Actions se­crets of any work­flow job us­ing CodeQL, and lever­age those se­crets to ex­e­cute fur­ther sup­ply chain at­tacks.

Compromise GitHub Actions se­crets of any work­flow us­ing the GitHub Actions Cache within a repo that uses CodeQL.

Supply chain at­tacks like these are scary, es­pe­cially when they start with some­thing as sim­ple as a pub­licly ex­posed cre­den­tial. If this is your first time hear­ing about abus­ing GitHub Actions to launch sup­ply chain at­tacks, I’ll let you in on a se­cret: these vul­ner­a­bil­i­ties oc­cur all the time.

Skip to main con­tent

You are the owner of this ar­ti­cle.

You have per­mis­sion to edit this ar­ti­cle.

Cloudy skies this morn­ing fol­lowed by scat­tered show­ers and thun­der­storms dur­ing the af­ter­noon. A few storms may be se­vere. High 77F. Winds SW at 10 to 20 mph. Chance of rain 40%..

Scattered thun­der­storms. Potential for se­vere thun­der­storms. Low 62F. Winds SW at 10 to 15 mph. Chance of rain 50%.

Inside a Marine’s de­ci­sion to eject from a fail­ing F-35B fighter jet and the be­trayal in its wake

Tony Bartelme, se­nior pro­jects re­porter for The Post and Courier, has earned na­tional hon­ors from the Nieman, Scripps, Loeb and National Press foun­da­tions, in­clud­ing Columbia University’s John Chancellor Award for cu­mu­la­tive achieve­ments in jour­nal­ism. He has writ­ten five books and is a four-time fi­nal­ist for the Pulitzer Prize. Reach Tony at tbartelme@po­stand­courier.com 843-425-8254

“I have read and agree to the Terms” is the biggest lie on the web. Together, we can fix that.

Facebook stores your data whether you have an ac­count or not.

Deleted con­tent is not re­ally deleted

This ser­vice keeps user logs for an un­de­fined pe­riod of time

Third-party cook­ies are used for ad­ver­tis­ing

Terms may be changed any time at their dis­cre­tion, with­out no­tice to the user

This ser­vice tracks you on other web­sites

The ser­vice can delete your ac­count with­out prior no­tice and with­out a rea­son

Voice data is col­lected and shared with third-par­ties

The ser­vice can delete spe­cific con­tent with­out prior no­tice and with­out a rea­son

This ser­vice may keep per­sonal data af­ter a re­quest for era­sure for busi­ness in­ter­ests or le­gal oblig­a­tions

Tracking via third-party cook­ies for other pur­poses with­out your con­sent.

The ser­vice can delete your ac­count with­out prior no­tice and with­out a rea­son

Users have a re­duced time pe­riod to take le­gal ac­tion against the ser­vice

The ser­vice may use track­ing pix­els, web bea­cons, browser fin­ger­print­ing, and/​or de­vice fin­ger­print­ing on users.

Your data may be processed and stored any­where in the world

Instead of ask­ing di­rectly, this Service will as­sume your con­sent merely from your us­age.

You can delete your ac­count and Duck Addresses

This ser­vice pro­vides an onion site ac­ces­si­ble over Tor

The ser­vice makes crit­i­cal changes to its terms with­out user in­volve­ment

Deleted videos are not re­ally deleted

Third-party cook­ies are used for ad­ver­tis­ing

This ser­vice gath­ers in­for­ma­tion about you through third par­ties

Reduction of le­gal pe­riod for cause of ac­tion

The ser­vice can delete spe­cific con­tent with­out prior no­tice and with­out a rea­son

Tracking via third-party cook­ies for other pur­poses with­out your con­sent.

The ser­vice col­lects many dif­fer­ent types of per­sonal data

This ser­vice may keep per­sonal data af­ter a re­quest for era­sure for busi­ness in­ter­ests or le­gal oblig­a­tions

The ser­vice can delete your ac­count with­out prior no­tice and with­out a rea­son

They store data on you even if you did not in­ter­act with the ser­vice

Tracking via third-party cook­ies for other pur­poses in­clud­ing ad­ver­tis­ing

This ser­vice may keep per­sonal data af­ter a re­quest for era­sure for busi­ness in­ter­ests or le­gal oblig­a­tions

This ser­vice tracks you on other web­sites

This ser­vice gath­ers in­for­ma­tion about you through third par­ties

The ser­vice can delete spe­cific con­tent with­out prior no­tice and with­out a rea­son

Some per­sonal data may be kept for busi­ness in­ter­ests or le­gal oblig­a­tions

This ser­vice tracks you on other web­sites

The copy­right li­cense main­tained by the ser­vice over user data and/​or con­tent is broader than nec­es­sary.

You can ac­cess most of the pages on the ser­vice’s web­site with­out re­veal­ing any per­sonal in­for­ma­tion

This ser­vice still tracks you even if you opted out from track­ing

The ser­vice col­lects many dif­fer­ent types of per­sonal data

This ser­vice does not track you

The ser­vice will re­sist le­gal re­quests for user in­for­ma­tion where rea­son­ably pos­si­ble

IP ad­dresses of web­site vis­i­tors are not tracked

The cook­ies used by this ser­vice do not con­tain in­for­ma­tion that would per­son­ally iden­tify you

The cook­ies used by this ser­vice do not con­tain in­for­ma­tion that would per­son­ally iden­tify you

This ser­vice can share your per­sonal in­for­ma­tion to third par­ties

This ser­vice tracks you on other web­sites

The ser­vice can delete your ac­count with­out prior no­tice and with­out a rea­son

This ser­vice forces users into bind­ing ar­bi­tra­tion in the case of dis­putes

The ser­vice can delete spe­cific con­tent with­out prior no­tice and with­out a rea­son

Terms may be changed any time at their dis­cre­tion, with­out no­tice to the user

The ser­vice col­lects many dif­fer­ent types of per­sonal data

This ser­vice shares your per­sonal data with third par­ties that are not in­volved in its op­er­a­tion

Content you post may be edited by the ser­vice for any rea­son

The ser­vice can delete spe­cific con­tent with­out rea­son and may do it with­out prior no­tice

Terms may be changed any time at their dis­cre­tion, with­out no­tice to the user

Many dif­fer­ent types of per­sonal data are col­lected

This ser­vice keeps a li­cense on user-gen­er­ated con­tent even af­ter users close their ac­counts.

ToS;DR aims to pro­vide easy-to-un­der­stand sum­maries of Privacy Policies and Terms of Service through a trans­par­ent and peer-re­viewed process.

Terms of ser­vice are re­viewed by vol­un­teer con­trib­u­tors, who high­light small points that we can dis­cuss, com­pare and ul­ti­mately as­sign a score: “good”, “neutral”, “bad”, and scari­est of all, “blocker”.

Once a ser­vice has enough points to as­sess the fair­ness of their terms, we use a for­mula to pro­vide rat­ings from Grade A to Grade E:Grade A — The terms of ser­vice treat you fairly, re­spect your rights, and will not abuse your data. Grade B — The terms of ser­vice are fair to­wards the user but they could be im­proved.Grade C — The terms of ser­vice are okay but some is­sues need your con­sid­er­a­tion.Grade D — The terms of ser­vice are very un­even, or there are some im­por­tant is­sues that need your at­ten­tion.Grade E — The terms of ser­vice raise very se­ri­ous con­cerns.No Grade Yet — Not enough in­for­ma­tion ex­ists to ac­cu­rately grade this ser­vice yet.

Right now you will no­tice that many ser­vices do not yet have a grade as­signed. This is where you come in! Help us analyse more doc­u­ments so that we may in­crease our cov­er­age.

So there I was, mind­ing my own busi­ness, doom-scrolling my way through Facebook posts when I hap­pened upon one that hit me straight in the nos­tal­gia. A photo of a 1980s home com­puter, a cas­sette player and some tapes. The text un­der­neath pro­claimed “In the 1980s, peo­ple could down­load video games from ra­dio broad­casts by record­ing the au­dio onto cas­sette tapes. These tapes could then be played on com­put­ers to load the games”. I nod­ded sagely to my­self as I re­mem­bered do­ing just that.

Then I started to read the com­ments un­der­neath and peo­ple were flat-out deny­ing that this had ever hap­pened. The re­ply guys broadly fell into two camps: the “I have never heard of this, there­fore it never hap­pened” and the over con­fi­dent “expert” say­ing things like “this would be tech­ni­cally im­pos­si­ble due to some fancy sound­ing words I’ve heard like ‘hertz’, ‘compression’ and ‘frequency shift key­ing’, there­fore it never hap­pened”.

Just to make sure I was in a splut­ter­ing rage the page it­self was ti­tled “Unbelievable facts” as if my own child­hood had be­come un­be­liev­able. Although now I think about it it was an un­be­liev­ably long time ago, so maybe they have a point.

Anyway, come back with me to the UK in the early 1980s. Recession, strikes, un­em­ploy­ment and the first fe­male Prime Minister, Margaret Thatcher, dom­i­nated the news. The home video cas­sette recorder was only just be­com­ing com­mon, the com­pact disc would­n’t be launched un­til the mid­dle of the decade and mo­bile phone net­works did­n’t even ex­ist. Dexy’s Midnight Runners, Irene Cara and Culture Club sound­tracked the era and, across the land, the home com­puter boom was boom­ing.

Computers were new, barely mak­ing their way even into the work­place. Most peo­ple in of­fice jobs were us­ing type­writ­ers, car­bon pa­pers and the postal sys­tem. But the mi­cro­proces­sor rev­o­lu­tion promised to make com­puter skills es­sen­tial to the econ­omy and so the British Broadcasting Corporation be­gan a pub­lic ed­u­ca­tion ex­er­cise : The BBC Computer Literacy Project.

The BBC’s pro­ject is best re­mem­bered for the TV pro­grammes fronted by Ian McNaught Davis and Chris Serle and, of course, the epony­mous BBC Micro spe­cially de­vel­oped by Acorn to ac­com­pany the pro­grammes. Less well known was a Radio 4 se­ries called The Chip Shop. According to the ever re­li­able in­ter­net, it was pre­sented by Barry Norman (much bet­ter known as a film critic than a tech­nol­ogy ex­pert) al­though I have no rec­ol­lec­tion of that.

Home com­put­ers at the time were a mar­vel of cost ef­fi­cient en­gi­neer­ing. Usually con­sist­ing of a chunky wedge-shaped key­board with all the gad­getry in­side, it used your nor­mal home TV as a dis­play and a nor­mal portable cas­sette recorded as a data stor­age de­vice. Software (which for most of us meant games) would be sup­plied on an au­dio cas­sette on which a se­ries of pierc­ing screech­ing noises were recorded. You’d hook up the cas­sette player to your com­puter, play the screech­ing noises into your com­puter through a ca­ble of some de­scrip­tion and af­ter a few min­utes your game would be loaded up and ready to play. Or, more of­ten, you’d hear sev­eral min­utes of screech­ing be­fore the process died with a cryp­tic mes­sage like “R Tape Error” and you’d have to start again.

There were many dif­fer­ent com­pa­nies mak­ing these com­put­ers all com­pet­ing for the nascent home mar­ket. And, with a few no­table ex­cep­tions, they were all in­com­pat­i­ble with each other and the screech­ing noises on cas­sette for, say, your ZX Spectrum would be of no use to the kid next door who had a Commodore 64. This pre­sented a prob­lem for Barry and his Chip Shop. The BBC wanted to broad­cast soft­ware as part of the ra­dio pro­gramme but they’d have to play a dif­fer­ent set of screech­ing noises for each type of com­puter and their reg­u­lar lis­ten­ers would be sub­jected to twenty min­utes of screech­ing noises at a time.

The so­lu­tion lay over the wa­ter in The Netherlands. The Dutch pub­lic broad­caster NOS had en­coun­tered the same prob­lem and had de­vel­oped a sys­tem called BASICODE. Often de­scribed as a kind of “Computer Esperanto”, it al­lowed the same soft­ware to run on dif­fer­ent types of com­puter. You would or­der a cas­sette that had BASICODE in­ter­preters for dif­fer­ent ma­chines, load up the one that matched your de­vice and then that in­ter­preter would load up the BASICODE pro­gram you’d recorded off your ra­dio.

The BBC ex­tended this sys­tem as BASICODE 2 (and later 2+) to in­clude more func­tion­al­ity and sup­port more brands of com­puter. And so was born The Chip Shop Takeaway. Late at night when any­one with any sense was asleep and not lis­ten­ing to their ra­dio, the BBC would broad­cast BASICODE pro­grams for home com­puter en­thu­si­asts to record and use on their ma­chines. To call these “video games” would be a bit of a stretch as BASICODE did­n’t re­ally sup­port any kind of graph­ics but I cer­tainly re­mem­ber some very ba­sic text-based games amongst a load of aca­d­e­mic soft­ware which meant ab­solutely noth­ing to me as an eight year old boy.

Nothing lasts for­ever though. The mass of com­pet­ing com­puter sys­tems be­came an un­sus­tain­able boom mar­ket. Manufacturers went broke, the range de­clined, tech­nol­ogy moved on and the boom be­came a bust. Newer 16 bit ma­chines es­chewed cas­sette stor­age for new-fan­gled disk dri­ves and the screech­ing of a BASICODE take­away be­came a for­got­ten sound on Britain’s ra­dio waves. According to Wikipedia BASICODE 3 was also de­vel­oped and con­tin­ued to be pop­u­lar in the old East Germany up un­til the early 1990s but for those of us in the UK it had al­ready moved into the realm of “unbelievable facts”.