A GitHub-hosted runner is an ephemeral virtual machine that GitHub Actions starts to execute a workflow job and then destroys when the job finishes. Because it is temporary, it is a convenient way to build, test, and deploy code without managing your own infrastructure.
In cyber security, the runner matters because it is still a live execution environment while the job is running. It can access repository code, build outputs, environment variables, and any secrets or tokens exposed to the workflow. If an attacker can influence a shell step through script injection or another workflow mistake, the runner can become a command-execution foothold and a place to harvest credentials. Defenders reduce this risk by treating workflow inputs as untrusted, using least-privilege permissions, avoiding direct shell interpolation, and pinning third-party actions to fixed commits.