A new wave of automated cyberattacks has emerged, targeting popular CI/CD pipelines through a series of sophisticated GitHub Actions exploits.
The attack, Step Security carried out by an autonomous bot called Hackerbot-Claw, began on February 21, 2026, and spanned a week, causing significant disruptions to several open-source repositories, including those from Microsoft, DataDog, and the CNCF.
Hackerbot-Claw, which identifies itself as an “autonomous security research agent powered by claude-opus-4-5,” methodically scanned public GitHub repositories for misconfigured workflows.
Over seven days, the bot triggered 12+ pull requests, successfully exploiting five different vulnerabilities in GitHub Actions workflows.
These vulnerabilities were mainly due on flawed permission configurations, such as the pull_request_target trigger, which allows malicious code to execute with elevated repository permissions.
Hackerbot-Claw executed arbitrary code in at least 4 of the targeted repositories and exfiltrated sensitive data, including GitHub tokens.
Notably, one of the tokens had write permissions, which allowed the attacker to push malicious commits to the repositories.
This attack also reached into the developer ecosystem through the compromise of Aqua Security’s Trivy VS Code extension, which was used to push a malicious artifact to the Open VSX marketplace.
Detailed Exploits Across Multiple Repositories
One of the most damaging attacks in this campaign occurred in the avelino/awesome-go repository, where Hackerbot-Claw exploited the Pwn Request vulnerability in a pull request workflow.
By injecting a malicious Go init() function into the quality check script, the bot exfiltrated the GitHub token to an external server.
With the stolen token, the attacker could modify the codebase, push commits, and merge pull requests in one of the most popular open-source repositories.
Another attack targeted project-akri/akri by injecting a malicious script directly into the version sh file.
The attacker used this modification to trigger a malicious payload when the repository’s auto-versioning workflow was triggered.
In this instance, the attacker did not need any advanced techniques just a direct script injection to execute the payload.
The attack on Microsoft/ai-discovery-agent used clever branch-name injection, hiding the payload within the branch name itself.
This tactic allowed the attacker to run a curl command that downloaded and executed malicious code.
Similarly, the DataDog/datadog-iac-scanner repository fell victim to filename injection, where base64-encoded shell commands were hidden within a file’s name and executed via a shell command in the workflow.
One of the most creative techniques involved manipulating Claude Code, an AI code reviewer used in the ambient-code/platform repository.
Hackerbot-Claw injected malicious prompts into the CLAUDE.md configuration file, attempting to trick the AI into committing unauthorized changes and posting a fake “Approved” review.
This type of attack demonstrated the emerging trend of AI-powered bots targeting other AI agents.
Impact and Mitigation
This campaign underscores the increasing sophistication of cyberattacks targeting CI/CD pipelines and developer environments.
Step Security the primary lesson here is the importance of securing GitHub Actions workflows with proper permission controls and ensuring that untrusted pull requests cannot manipulate automated workflows.
Organizations using GitHub Actions should implement automated guardrails to detect vulnerabilities such as Pwn Requests, script injection, and other insecure configurations.
Additionally, monitoring for unusual behavior and suspicious outbound network calls, such as those used to exfiltrate data, can help mitigate potential risks.
In response to this attack, several maintainers, including those at DataDog, deployed emergency fixes to secure their workflows.
Meanwhile, Aqua Security swiftly revoked the compromised GitHub token and restored access to its Trivy repository.
As software supply chains become more automated, securing these environments against bot-driven attacks is more critical than ever.
Developers and organizations must adopt a defense-in-depth strategy that combines automated security tools and vigilant monitoring to stay one step ahead of these evolving threats.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
