Cases › security breach › LR-2026-0449
Malicious Rust crates and AI bot exploit CI/CD pipelines to steal secrets
Preliminary Why: 1 report: The Hacker News · subject to change · 1 independent report
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Status: advice only, no fix reported
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
Severity major: Test: many third parties, meaning a stated count of two or more affected parties. Fact: no less than seven repositories belonging to Microsoft, Datadog, and Aqua Security, among others, were targeted.
An automated campaign, attributed to an AI-powered bot called hackerbot-claw, scanned public repositories for misconfigured GitHub Actions CI/CD workflows to harvest developer secrets. Between February 21 and February 28, 2026 it targeted no less than seven repositories belonging to Microsoft, Datadog and Aqua Security, among others. The bot exploited a pull_request_target workflow to steal a Personal Access Token, which was then used to take over the repository. Using the GitHub Actions workflow, the attacker pushed a malicious Trivy VS Code extension to Open VSX, where it ran local AI coding assistants in permissive modes to collect sensitive data. Separately, five malicious Rust crates masquerading as time utilities exfiltrated .env files. Aqua Security removed the artifacts and revoked the token, and the crates were removed from crates.io. Pillar Security assessed the bot as a human operator using an LLM, so attribution to an autonomous AI agent is disputed.
What happened
What was done
“Prioritize controls that stop malicious dependencies before they execute.”
Risks
Primary96 incidents
Rising: 24 vs 4.0 a week
Also24 incidents
Rising: 4 vs 0.2 a week
Read from the sources; not yet reviewed by a person.
Controls
ApplicationDid not exist Live behaviour monitoring
Control failure chain
L1 · ModelProvider not namedModel provider
No source mentions a control at this layer.
Model version not linked to a model card.
Other controls for this risk at this layer, not mentioned in the sources: Safety training and refusal, Cyber and weapons safeguards, Abuse monitoring and account enforcement, Staged or restricted release, Dangerous-capability testing before release, Outside red-teaming, Content safety classifiers, Safeguards kept on in testing, Reasoning monitoring.
L2 · HarnessHarness not namedAgent framework vendor
No source mentions a control at this layer.
L3 · ApplicationThe attackerDeployer
The attacker ran the agent; this layer was the attacker's own.
L4 · Infrastructure / targetOrganisation hit
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Known flaws patched, Multi-factor sign-in and password policy, Network segmentation, Intrusion and endpoint detection, Backups and recovery, Phishing and fraud filters.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Content safety classifiers | L1 Model | Not stated in sources |
| Safety training and refusal | L1 Model | Not stated in sources |
| Cyber and weapons safeguards | L1 Model | Not stated in sources |
| Dangerous-capability testing before release | L1 Model | Not stated in sources |
| Outside red-teaming | L1 Model | Not stated in sources |
| Staged or restricted release | L1 Model | Not stated in sources |
| Abuse monitoring and account enforcement | L1 Model | Not stated in sources |
| Reasoning monitoring | L1 Model | Not stated in sources |
| Safeguards kept on in testing | L1 Model | Not stated in sources |
| Live behaviour monitoring | L3 Application | Did not exist |
| Known flaws patched | L4 Infrastructure / target | Not stated in sources |
| Multi-factor sign-in and password policy | L4 Infrastructure / target | Not stated in sources |
| Network segmentation | L4 Infrastructure / target | Not stated in sources |
| Intrusion and endpoint detection | L4 Infrastructure / target | Not stated in sources |
| Backups and recovery | L4 Infrastructure / target | Not stated in sources |
| Phishing and fraud filters | L4 Infrastructure / target | Not stated in sources |
Evidence
No source states: how it was caught, when it was found, how many records were exposed, the direct loss, any court case, the cause, what set it off.
Show the full account: 6 items from the primary sources
What happened, in order
- February 21 to February 28, 2026 The GitHub account targeted no less than seven repositories belonging to Microsoft, Datadog, and Aqua Security, among others.
Not dated in the sources:
- The bot exploited a pull_request_target workflow to steal a Personal Access Token.
- The stolen credential was used to take over the repository.
- The attacker used the GitHub Actions workflow to push a malicious Trivy VS Code extension to the Open VSX registry.
- Aqua removed the artifacts from the marketplace and revoked the token used to publish them.
- The malicious Rust crates were removed from crates.io.
Show every field, with its source and grade
What happened
Impact
Notes on gaps
The crates campaign is attributed to a single threat actor separately from hackerbot-claw; the source does not say the two are linked. Trivy extension versions 1.8.12 and 1.8.13 and CVE-2026-28353 appear in the source but are not recorded as fields.
LR-2026-0449 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON