A GitHub Actions runner is the execution environment that carries out workflow jobs for a repository. It can be GitHub-hosted, where the runner is created temporarily for a job, or self-hosted, where the organization manages the machine or container. The runner is where build steps, scripts, and automation actually run.
This matters in security because the runner often has access to repository code, workflow inputs, and sometimes secrets or tokens. If an attacker compromises a repository or abuses a workflow, the runner can become a launch point for scanning, data theft, or further intrusion. In defense, limit token scope, review third-party actions, prefer ephemeral runners when possible, and monitor for unusual workflow execution or secret access. A compromised self-hosted runner is especially risky because it may retain attacker control beyond one job.