{"schema_version":"0.10.0","id":"LR-2026-0402","record_version":1,"title":"hackerbot-claw AI bot actively exploits GitHub Actions workflows","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":46.2,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":5.76,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"StepSecurity research","original_document":{"url":"https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation","organisation":"StepSecurity","role":"researcher"},"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"StepSecurity research"}]},"sources_hash":"324cbeb5a3763b769ea3e6a8f1dd390ce577ad7d8bcb75c1f0b5ce2a2a70cb4d"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"full-auto","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-02-20","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"An autonomous bot account, hackerbot-claw, scanned public repositories for exploitable GitHub Actions workflows and planted payloads that ran inside CI jobs. Its attacks used several techniques, including a poisoned Go init function, script and branch-name injection, and a prompt injection aimed at an AI code reviewer. The source reports remote code execution in several targets and the theft of a write-permission GitHub token from one repository. In the Trivy case, a stolen personal access token was used to push a commit directly to the repository and to delete releases. The Claude code reviewer detected and refused the injected instructions it read. Aqua Security later restored public access to Trivy and removed the vulnerable workflow.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":"pull_request_target workflows checked out attacker fork code and ran it with repository secrets","failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":"workflow subsequently disabled","remediation":null,"precursor_events":null,"primary_risk":"RK03","secondary_risks":["RK01"],"control_chain":[{"layer":"L3","party":"deployer","party_name":null,"control_id":"A1","outcome":"missing","reason":null,"quote":"In the awesome-go attack, the workflow ran with contents: write and pull-requests: write — far more than a quality check script needs.","source_index":0,"reviewed":false},{"layer":"L2","party":"harness_vendor","party_name":null,"control_id":"C2","outcome":"held","reason":null,"quote":"Claude Code (running claude-sonnet-4-6) identified both injection attempts immediately and refused to comply with any injected instructions.","source_index":0,"reviewed":false},{"layer":"L2","party":"harness_vendor","party_name":null,"control_id":"A6","outcome":"held","reason":null,"quote":"The workflow's tool allowlisting provided an additional layer of protection: Claude was restricted to gh pr comment, gh pr diff, gh pr view, and gh issue list bash commands only — no file writes or git operations were permitted even if Claude had been tricked.","source_index":0,"reviewed":false},{"layer":"L3","party":"deployer","party_name":null,"control_id":"B4","outcome":"got_around","reason":null,"quote":"Nineteen minutes after the workflow run, at 03:47 UTC, the stolen PAT was used to push commit d267cc4 directly to the repository — bypassing the PR process entirely.","source_index":0,"reviewed":false}],"remediations":[{"by":null,"kind":"advice","date_reported":null,"controls_added":["A1"],"quote":"By restricting tokens to contents: read where write access isn't needed, you limit the blast radius of any compromise.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"major test met: many third parties (stated count of at least 4 of 7 targeted repositories with remote code execution)","harm_class":["third_party_security"],"affected_description":"Owners of at least 7 targeted repositories, including Microsoft, DataDog, CNCF and other open source projects","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation","publisher":"Step Security","date":"2026-02-20","type":"press","title":"hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft, DataDog, and CNCF Projects Hit So Far - Step Security","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"event.incident_class":"C","event.agent_involved":"C","event.adversarial_actor":"C","event.root_cause_detail":"C","event.operations_paused":"C","system.autonomy_level":"C","impact.harm_class":"C","impact.affected_description":"C","context.industry":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.control_chain":"C","event.remediations":"C","event.summary":"C","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"A week-long automated attack campaign targeted CI/CD pipelines across major open source repositories, achieving remote code execution in at least 4 out of 7 targets."}],"event.agent_involved":[{"source_index":0,"quote":"This was an autonomous bot scanning repos continuously."}],"event.adversarial_actor":[{"source_index":0,"quote":"Between February 21 and March 2, 2026, a GitHub account called hackerbot-claw systematically scanned public repositories for exploitable GitHub Actions workflows."}],"event.root_cause_detail":[{"source_index":0,"quote":"The pull_request_target trigger gives the workflow access to the target repository's secrets and permissions but the checkout fetches the attacker's fork code."}],"event.operations_paused":[{"source_index":0,"quote":"Detected and blocked. Claude refused the injection; workflow subsequently disabled."}],"system.autonomy_level":[{"source_index":0,"quote":"This was an autonomous bot scanning repos continuously."}],"impact.harm_class":[{"source_index":0,"quote":"The attacker, an autonomous bot called hackerbot-claw, used 5 different exploitation techniques and successfully exfiltrated a GitHub token with write permissions from one of the most popular repositories on GitHub."}],"impact.affected_description":[{"source_index":0,"quote":"Targeted at least 7 repositories belonging to Microsoft, DataDog, the CNCF, and popular open source projects"}],"context.industry":[{"source_index":0,"quote":"A week-long automated attack campaign targeted CI/CD pipelines across major open source repositories, achieving remote code execution in at least 4 out of 7 targets."}],"impact.severity":[{"source_index":0,"quote":"A week-long automated attack campaign targeted CI/CD pipelines across major open source repositories, achieving remote code execution in at least 4 out of 7 targets."}],"impact.severity_because":[{"source_index":0,"quote":"A week-long automated attack campaign targeted CI/CD pipelines across major open source repositories, achieving remote code execution in at least 4 out of 7 targets."}],"event.control_chain":[{"source_index":0,"quote":"In the awesome-go attack, the workflow ran with contents: write and pull-requests: write — far more than a quality check script needs."},{"source_index":0,"quote":"Claude Code (running claude-sonnet-4-6) identified both injection attempts immediately and refused to comply with any injected instructions."},{"source_index":0,"quote":"The workflow's tool allowlisting provided an additional layer of protection: Claude was restricted to gh pr comment, gh pr diff, gh pr view, and gh issue list bash commands only — no file writes or git operations were permitted even if Claude had been tricked."},{"source_index":0,"quote":"Nineteen minutes after the workflow run, at 03:47 UTC, the stolen PAT was used to push commit d267cc4 directly to the repository — bypassing the PR process entirely."}],"event.remediations":[{"source_index":0,"quote":"By restricting tokens to contents: read where write access isn't needed, you limit the blast radius of any compromise."}],"event.summary":[{"source_index":0,"quote":"Between February 21 and March 2, 2026, a GitHub account called hackerbot-claw systematically scanned public repositories for exploitable GitHub Actions workflows."},{"source_index":0,"quote":"The attacker, an autonomous bot called hackerbot-claw, used 5 different exploitation techniques and successfully exfiltrated a GitHub token with write permissions from one of the most popular repositories on GitHub."},{"source_index":0,"quote":"Claude Code (running claude-sonnet-4-6) identified both injection attempts immediately and refused to comply with any injected instructions."},{"source_index":0,"quote":"Nineteen minutes after the workflow run, at 03:47 UTC, the stolen PAT was used to push commit d267cc4 directly to the repository — bypassing the PR process entirely."},{"source_index":0,"quote":"Restored the repository to public access (though stars dropped from 25k+ to ~25 due to the repo being recreated)"}]},"notes_on_gaps":"Single press and vendor source (StepSecurity, a commercial vendor whose post promotes its own products). Sources conflict on counts: at least 4 of 7 targets with code execution, 5 of 7 compromised, and at least 6 with code execution; no count was used for third_parties_affected_count. Duration and campaign dates conflict (a week-long campaign, over 10 days, Feb 21 to Mar 2) and the disclosure date is not stated and conflicts with later events; date fields and duration were left out. The timeline was sorted chronologically, which differs from the source's order. The bot's self-described model (claude-opus-4-5) is an unverified claim by the account and was not recorded. No failure_class was set and no trigger was set because the sources do not settle them. Detection method and responsible party were not stated. The defending Claude reviewer's tool list and model are not recorded as the incident system. Missing authorization checks on comment-triggered workflows have no matching control id and are described only in the summary. The Trivy workflow removal adds no listed control, so it is not recorded as a remediation entry. Harden-Runner egress claims are vendor assertions and were not recorded as held or missing controls. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (StepSecurity research)]"},"context":{"industry":"open source software","org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"Workflows using pull_request_target checked out untrusted fork code and ran it with repository secrets.","quote":"The pull_request_target trigger gives the workflow access to the target repository's secrets and permissions but the checkout fetches the attacker's fork code.","source_index":0,"grade":"C"},{"step":"reached","text":"The exfiltrated token could let the attacker push commits, modify code and merge pull requests.","quote":"With the exfiltrated token (contents: write, pull-requests: write), the attacker could push commits, modify code, and merge PRs in one of GitHub's most popular repositories.","source_index":0,"grade":"C"},{"step":"caught","text":"The AI code reviewer identified both injection attempts and refused to follow the injected instructions.","quote":"Claude Code (running claude-sonnet-4-6) identified both injection attempts immediately and refused to comply with any injected instructions.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation"]},"analysis":{"sections":{"timeline":[{"text":"hackerbot-claw account created","quote":"Feb 20: - hackerbot-claw account created","source_index":0,"when":"Feb 20"},{"text":"microsoft/ai-discovery-agent PR #236 branch name injection","quote":"Feb 27, 05:14 UTC - microsoft/ai-discovery-agent PR #236 - branch name injection","source_index":0,"when":"Feb 27, 05:14 UTC"},{"text":"DataDog/datadog-iac-scanner PR #7 filename injection","quote":"Feb 27, 05:26 UTC - DataDog/datadog-iac-scanner PR #7 - filename injection","source_index":0,"when":"Feb 27, 05:26 UTC"},{"text":"DataDog deployed emergency workflow fixes","quote":"Feb 27, 14:33 UTC - DataDog deploys emergency workflow fixes (~9 hours after attack)","source_index":0,"when":"Feb 27, 14:33 UTC"},{"text":"awesome-go first attempt (PR #6058)","quote":"Feb 28, 00:57 UTC - awesome-go first attempt (PR #6058)","source_index":0,"when":"Feb 28, 00:57 UTC"},{"text":"aquasecurity/trivy pull_request_target workflow exploited; PAT stolen","quote":"Feb 28, 03:28 UTC - aquasecurity/trivy - pull_request_target workflow exploited; PAT stolen","source_index":0,"when":"Feb 28, 03:28 UTC"},{"text":"Stolen PAT used to push commit d267cc4 directly to the aquasecurity/trivy repository","quote":"Nineteen minutes after the workflow run, at 03:47 UTC, the stolen PAT was used to push commit d267cc4 directly to the repository — bypassing the PR process entirely.","source_index":0,"when":"03:47 UTC"},{"text":"ambient-code/platform PR #732 AI prompt injection detected by Claude","quote":"Feb 28, 05:26 UTC - ambient-code/platform PR #732 - AI prompt injection - detected by Claude","source_index":0,"when":"Feb 28, 05:26 UTC"},{"text":"awesome-go PR #6068 confirmed RCE","quote":"Feb 28, 18:03 UTC - awesome-go PR #6068 - confirmed RCE","source_index":0,"when":"Feb 28, 18:03 UTC"},{"text":"awesome-go PR #6069 confirmed RCE and GITHUB_TOKEN exfiltration","quote":"Feb 28, 18:14 UTC - awesome-go PR #6069 - confirmed RCE + GITHUB_TOKEN exfiltration","source_index":0,"when":"Feb 28, 18:14 UTC"},{"text":"project-akri/akri PR #783 confirmed RCE","quote":"Feb 28, 18:28 UTC -project-akri/akri PR #783 - confirmed RCE","source_index":0,"when":"Feb 28, 18:28 UTC"},{"text":"Aqua Security restores trivy repo, removes vulnerable workflow, publishes v0.69.2","quote":"Mar 1 - Aqua Security restores trivy repo; removes vulnerable workflow; publishes v0.69.2","source_index":0,"when":"Mar 1"},{"text":"RustPython/RustPython PR #7309 base64 branch name injection","quote":"Mar 2, 05:57 UTC - RustPython/RustPython PR #7309 - base64 branch name injection","source_index":0,"when":"Mar 2, 05:57 UTC"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation"]}}