{"schema_version":"0.10.0","id":"LR-2026-0449","record_version":1,"title":"Malicious Rust crates and AI bot exploit CI/CD pipelines to steal secrets","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":48.0,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":4.48,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: The Hacker News · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: The Hacker News · subject to change"}]},"sources_hash":"0bc5e5ffb33e4dee7f74fbb5054dca48a5513d25fb6742d7f3c0bada797e3f5a"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":"2026-02-01","date_occurred_precision":"month","date_disclosed":"2026-03-11","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"An automated campaign, attributed to an AI-powered bot called hackerbot-claw, scanned public repositories for misconfigured GitHub Actions CI/CD workflows to harvest developer secrets. Between February 21 and February 28, 2026 it targeted no less than seven repositories belonging to Microsoft, Datadog and Aqua Security, among others. The bot exploited a pull_request_target workflow to steal a Personal Access Token, which was then used to take over the repository. Using the GitHub Actions workflow, the attacker pushed a malicious Trivy VS Code extension to Open VSX, where it ran local AI coding assistants in permissive modes to collect sensitive data. Separately, five malicious Rust crates masquerading as time utilities exfiltrated .env files. Aqua Security removed the artifacts and revoked the token, and the crates were removed from crates.io. Pillar Security assessed the bot as a human operator using an LLM, so attribution to an autonomous AI agent is disputed.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":"A pull_request_target CI workflow was exploited to steal a Personal Access Token","failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK07","secondary_risks":["RK03","RK06"],"control_chain":[{"layer":"L3","party":"attacker","party_name":null,"control_id":"F2","outcome":"missing","reason":null,"quote":"The hackerbot-claw campaign exploited a gap that most organizations don't even know exists: zero visibility into AI coding agents running on developer machines, and no runtime controls when those agents are weaponized.","source_index":0,"reviewed":false}],"remediations":[{"by":null,"kind":"advice","date_reported":null,"controls_added":["G3"],"quote":"Prioritize controls that stop malicious dependencies before they execute.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Test: many third parties, meaning a stated count of two or more affected parties. Fact: no less than seven repositories belonging to Microsoft, Datadog, and Aqua Security, among others, were targeted.","harm_class":[],"affected_description":"Repositories belonging to Microsoft, Datadog, and Aqua Security, among others","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/03/five-malicious-rust-crates-and-ai-bot.html","publisher":"The Hacker News","date":"2026-03-11","type":"press","title":"Five Malicious Rust Crates and AI Bot Exploit CI/CD Pipelines to Steal Developer Secrets - The Hacker News","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"event.date_occurred":"C","event.incident_class":"C","event.root_cause_detail":"C","impact.affected_description":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.control_chain":"C","event.remediations":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.date_occurred":[{"source_index":0,"quote":"Between February 21 and February 28, 2026, the GitHub account, which described itself as an autonomous security research agent, targeted no less than seven repositories belonging to Microsoft, Datadog, and Aqua Security, among others."}],"event.incident_class":[{"source_index":0,"quote":"Cybersecurity researchers have discovered five malicious Rust crates that masquerade as time-related utilities to transmit .env file data to the threat actors."}],"event.root_cause_detail":[{"source_index":0,"quote":"Hackerbot-claw exploited a pull_request_target workflow to steal a Personal Access Token (PAT)"}],"impact.affected_description":[{"source_index":0,"quote":"Between February 21 and February 28, 2026, the GitHub account, which described itself as an autonomous security research agent, targeted no less than seven repositories belonging to Microsoft, Datadog, and Aqua Security, among others."}],"impact.severity":[{"source_index":0,"quote":"Between February 21 and February 28, 2026, the GitHub account, which described itself as an autonomous security research agent, targeted no less than seven repositories belonging to Microsoft, Datadog, and Aqua Security, among others."}],"impact.severity_because":[{"source_index":0,"quote":"Between February 21 and February 28, 2026, the GitHub account, which described itself as an autonomous security research agent, targeted no less than seven repositories belonging to Microsoft, Datadog, and Aqua Security, among others."}],"event.control_chain":[{"source_index":0,"quote":"The hackerbot-claw campaign exploited a gap that most organizations don't even know exists: zero visibility into AI coding agents running on developer machines, and no runtime controls when those agents are weaponized."}],"event.remediations":[{"source_index":0,"quote":"Prioritize controls that stop malicious dependencies before they execute."}],"event.summary":[{"source_index":0,"quote":"Between February 21 and February 28, 2026, the GitHub account, which described itself as an autonomous security research agent, targeted no less than seven repositories belonging to Microsoft, Datadog, and Aqua Security, among others."},{"source_index":0,"quote":"Hackerbot-claw exploited a pull_request_target workflow to steal a Personal Access Token (PAT)"},{"source_index":0,"quote":"The stolen credential was then used to take over the repository."},{"source_index":0,"quote":"Aqua has since removed the artifacts from the marketplace and revoked the token used to publish them."},{"source_index":0,"quote":"Cybersecurity researchers have discovered five malicious Rust crates that masquerade as time-related utilities to transmit .env file data to the threat actors."},{"source_index":0,"quote":"Pillar Security has assessed hackerbot-claw to be a human operator using a large language model (LLM) as an execution layer."}]},"notes_on_gaps":"Single press source; no primary report from Aqua, Socket or StepSecurity was provided. The hackerbot-claw bot's autonomy is disputed: it described itself as an autonomous agent but Pillar Security assessed it as a human operator using an LLM, so agent_involved is set true on the self-description and the dispute is noted here. No model, developer, harness, tools or permissions for the bot were stated, so system fields are omitted. No detection method, trigger or responsible party was stated. The disclosure date equals the article date (2026-03-11) but is not stated in the body, so date_disclosed is omitted. Date_occurred is recorded as month-level 2026-02 because the sources give a range within February. Aqua's statement timing ('last week') is not resolved to a date. Severity major is my judgement under the many-third-parties test. The control mappings A3 for token revocation and G3 for Socket's advice are my judgement, not stated by the source. The crates campaign is attributed to a single threat actor separately from hackerbot-claw; the source does not say the two are linked. Trivy extension versions 1.8.12 and 1.8.13 and CVE-2026-28353 appear in the source but are not recorded as fields. Country and industry are not stated. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: The Hacker News · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"An AI-powered bot called hackerbot-claw scanned public repositories for exploitable GitHub Actions workflows to harvest developer secrets.","quote":"The disclosure follows the discovery of an automated attack campaign that targeted CI/CD pipelines spanning major open-source repositories, with an artificial intelligence (AI)-powered bot called hackerbot-claw scanning public repositories for exploitable GitHub Actions workflows to harvest developer secrets.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The bot exploited a pull_request_target workflow to steal a Personal Access Token.","quote":"Hackerbot-claw exploited a pull_request_target workflow to steal a Personal Access Token (PAT)","source_index":0,"grade":"C"},{"step":"reached","text":"The stolen credential was then used to take over the repository.","quote":"The stolen credential was then used to take over the repository.","source_index":0,"grade":"C"},{"step":"done","text":"Aqua removed the artifacts from the marketplace and revoked the token used to publish them.","quote":"Aqua has since removed the artifacts from the marketplace and revoked the token used to publish them.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/03/five-malicious-rust-crates-and-ai-bot.html"]},"analysis":{"sections":{"timeline":[{"text":"The GitHub account targeted no less than seven repositories belonging to Microsoft, Datadog, and Aqua Security, among others.","quote":"Between February 21 and February 28, 2026, the GitHub account, which described itself as an autonomous security research agent, targeted no less than seven repositories belonging to Microsoft, Datadog, and Aqua Security, among others.","source_index":0,"when":"February 21 to February 28, 2026"},{"text":"The bot exploited a pull_request_target workflow to steal a Personal Access Token.","quote":"Hackerbot-claw exploited a pull_request_target workflow to steal a Personal Access Token (PAT)","source_index":0,"when":null},{"text":"The stolen credential was used to take over the repository.","quote":"The stolen credential was then used to take over the repository.","source_index":0,"when":null},{"text":"The attacker used the GitHub Actions workflow to push a malicious Trivy VS Code extension to the Open VSX registry.","quote":"In a statement issued last week, Aqua Security's Itay Shakury revealed that the attacker leveraged the GitHub Actions workflow to push a malicious version of Trivy's Visual Studio Code (VS Code) extension to the Open VSX registry to leverage local AI coding agents to collect and exfiltrate sensitive information.","source_index":0,"when":null},{"text":"Aqua removed the artifacts from the marketplace and revoked the token used to publish them.","quote":"Aqua has since removed the artifacts from the marketplace and revoked the token used to publish them.","source_index":0,"when":null},{"text":"The malicious Rust crates were removed from crates.io.","quote":"While the packages have since been removed from crates.io","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/03/five-malicious-rust-crates-and-ai-bot.html"]}}