An ephemeral runner is a temporary CI worker that is created for a single build, test, or deployment job and then destroyed. Because it does not persist between jobs, it reduces leftover files, cached data, and long-lived credentials that could be reused by an attacker.
In cyber security, ephemeral runners matter because install-time scripts, malicious build steps, or compromised dependencies may try to read environment variables, token files, or cloud metadata during execution. If the runner disappears after the job, there is less chance for secrets to remain on disk or for an attacker to move from one task to the next. Defenders pair ephemeral runners with short-lived credentials, tight secret scoping, and limited permissions to shrink the blast radius of supply-chain attacks and CI/CD compromise.