Cases › security breach › LR-2026-0402

hackerbot-claw AI bot actively exploits GitHub Actions workflows

Confirmed Why: StepSecurity research · StepSecurity · 1 independent report

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: advice only, no fix reported

Severity major

Reported 20 Feb 2026

Industry open source software

No source states: loss or records, developer and model, agent tool, could do, deployer.

Severity major: test met: many third parties (stated count of at least 4 of 7 targeted repositories with remote code execution)

An autonomous bot account, hackerbot-claw, scanned public repositories for exploitable GitHub Actions workflows and planted payloads that ran inside CI jobs. Its attacks used several techniques, including a poisoned Go init function, script and branch-name injection, and a prompt injection aimed at an AI code reviewer. The source reports remote code execution in several targets and the theft of a write-permission GitHub token from one repository. In the Trivy case, a stolen personal access token was used to push a commit directly to the repository and to delete releases. The Claude code reviewer detected and refused the injected instructions it read. Aqua Security later restored public access to Trivy and removed the vulnerable workflow.

What happened

1 · What went wrongWorkflows using pull_request_target checked out untrusted fork code and ran it with repository secrets.

2 · What it reached or didThe exfiltrated token could let the attacker push commits, modify code and merge pull requests.

3 · How it was caughtThe AI code reviewer identified both injection attempts and refused to follow the injected instructions.

What was done

Advice in source, not a fix by the party

“By restricting tokens to contents: read where write access isn't needed, you limit the blast radius of any compromise.”

Least-privilege access for the agent

Risks

Credential and privilege abuse
Primary37 incidents

Hidden instructions hijack the agent
Also50 incidents
Rising: 6 vs 2.8 a week

Read from the sources; not yet reviewed by a person.

Controls

Harness

Effective Prompt-injection detection
Effective Tool allow-list

Application

Did not exist Least-privilege access for the agent
Not effective (bypassed) Change review and separation of duties

Control failure chain

L1 · Model Not stated in sourcesProvider not named

L2 · Harness EffectiveHarness not named

L3 · Application Did not existDeployer not named

L4 · Infrastructure / target Not stated in sourcesOrganisation hit

L1 · ModelProvider not namedModel provider

No source mentions a control at this layer.

Model version not linked to a model card.

L2 · HarnessHarness not namedAgent framework vendor

EffectivePrompt-injection detection“Claude Code (running claude-sonnet-4-6) identified both injection attempts immediately and refused to comply with any injected instructions.”Step Security

EffectiveTool allow-list“The workflow's tool allowlisting provided an additional layer of protection: Claude was restricted to gh pr comment, gh pr diff, gh pr view, and gh issue list bash commands only — no file writes or git operations were permitted even if Claude had been tricked.”Step Security

L3 · ApplicationDeployer not namedDeployer

Did not existLeast-privilege access for the agent“In the awesome-go attack, the workflow ran with contents: write and pull-requests: write — far more than a quality check script needs.”Step Security

Not effective (bypassed)Change review and separation of duties“Nineteen minutes after the workflow run, at 03:47 UTC, the stolen PAT was used to push commit d267cc4 directly to the repository — bypassing the PR process entirely.”Step Security

Other controls for this risk at this layer, not mentioned in the sources: Short-lived, scoped credentials, Secrets kept out of the model's context, Separate identity for each agent, Alerts on unusual tool use, Activity logs, Sensitive-data checks on outbound data.

L4 · Infrastructure / targetOrganisation hit

No source mentions a control at this layer.

Other controls for this risk at this layer, not mentioned in the sources: Multi-factor sign-in and password policy, Secrets scanning.

EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target

Controls for this risk: result in this incident

Control	Part of the system	Result
Tool allow-list	L2 Harness	Effective
Prompt-injection detection	L2 Harness	Effective
Least-privilege access for the agent	L3 Application	Did not exist
Change review and separation of duties	L3 Application	Not effective (bypassed)
Separate identity for each agent	L3 Application	Not stated in sources
Short-lived, scoped credentials	L3 Application	Not stated in sources
Secrets kept out of the model's context	L3 Application	Not stated in sources
Activity logs	L3 Application	Not stated in sources
Alerts on unusual tool use	L3 Application	Not stated in sources
Sensitive-data checks on outbound data	L3 Application	Not stated in sources
Multi-factor sign-in and password policy	L4 Infrastructure / target	Not stated in sources
Secrets scanning	L4 Infrastructure / target	Not stated in sources

Evidence

No source states: what the AI was doing, when it happened, when it was found, how many records were exposed, the direct loss, any court case, the cause, what set it off, what was done.

Show the full account: 12 items from the primary sources

What happened, in order

Feb 20 hackerbot-claw account created
Feb 27, 05:14 UTC microsoft/ai-discovery-agent PR #236 branch name injection
Feb 27, 05:26 UTC DataDog/datadog-iac-scanner PR #7 filename injection
Feb 27, 14:33 UTC DataDog deployed emergency workflow fixes
Feb 28, 00:57 UTC awesome-go first attempt (PR #6058)
Feb 28, 03:28 UTC aquasecurity/trivy pull_request_target workflow exploited; PAT stolen
Feb 28, 05:26 UTC ambient-code/platform PR #732 AI prompt injection detected by Claude
Feb 28, 18:14 UTC awesome-go PR #6069 confirmed RCE and GITHUB_TOKEN exfiltration
Feb 28, 18:28 UTC project-akri/akri PR #783 confirmed RCE
Mar 1 Aqua Security restores trivy repo, removes vulnerable workflow, publishes v0.69.2
Mar 2, 05:57 UTC RustPython/RustPython PR #7309 base64 branch name injection

Not dated in the sources:

Stolen PAT used to push commit d267cc4 directly to the aquasecurity/trivy repository

Show every field, with its source and grade

The AI system

How much it acted alone

it acted alone, unwatched

C one secondary source states it

What happened

Earliest source we hold

2026-02-20

D inferred by us from the described behaviour, reason shown

Cause in detail

pull_request_target workflows checked out attacker fork code and ran it with repository secrets

C one secondary source states it

Who caused it

an outside attacker

C one secondary source states it

What was stopped

workflow subsequently disabled

C one secondary source states it

What went wrong

security breach

C one secondary source states it

AI agent

an AI agent acted

C one secondary source states it

primary risk

RK03

D inferred by us from the described behaviour, reason shown

secondary risks

RK01

D inferred by us from the described behaviour, reason shown

control chain

layer: L3; party: deployer; control id: A1; outcome: missing; quote: In the awesome-go attack, the workflow ran with contents: write and pull-requests: write — far more than a quality check script needs.; source index: 0, layer: L2; party: harness vendor; control id: C2; outcome: held; quote: Claude Code (running claude-sonnet-4-6) identified both injection attempts immediately and refused to comply with any injected instructions.; source index: 0, layer: L2; party: harness vendor; control id: A6; outcome: held; quote: The workflow's tool allowlisting provided an additional layer of protection: Claude was restricted to gh pr comment, gh pr diff, gh pr view, and gh issue list bash commands only — no file writes or git operations were permitted even if Claude had been tricked.; source index: 0, layer: L3; party: deployer; control id: B4; outcome: got around; quote: Nineteen minutes after the workflow run, at 03:47 UTC, the stolen PAT was used to push commit d267cc4 directly to the repository — bypassing the PR process entirely.; source index: 0

C one secondary source states it

remediations

kind: advice; controls added: A1; quote: By restricting tokens to contents: read where write access isn't needed, you limit the blast radius of any compromise.; source index: 0

C one secondary source states it

Impact

Severity

major

D inferred by us from the described behaviour, reason shown

Kind of harm

others' security

C one secondary source states it

Who was affected

Owners of at least 7 targeted repositories, including Microsoft, DataDog, CNCF and other open source projects

C one secondary source states it

Why this severity

test met: many third parties (stated count of at least 4 of 7 targeted repositories with remote code execution)

D inferred by us from the described behaviour, reason shown

Context

Industry

open source software

C one secondary source states it

Notes on gaps

The timeline was sorted chronologically, which differs from the source's order. The bot's self-described model (claude-opus-4-5) is an unverified claim by the account and was not recorded. The defending Claude reviewer's tool list and model are not recorded as the incident system. Missing authorization checks on comment-triggered workflows have no matching control id and are described only in the summary. The Trivy workflow removal adds no listed control, so it is not recorded as a remediation entry.

LR-2026-0402 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON