hackerbot-claw Operation Review: Pull Requests as an Attack Vector in GitHub Actions

Back Upwind

hackerbot-claw Operation Review: Pull Requests as an Attack Vector in GitHub Actions

Upwind • March 2, 2026

Share: View original

Autonomous bot hackerbot-claw exploited GitHub Actions pull_request_target workflows to achieve RCE and steal GITHUB_TOKEN credentials.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Automated AI Attack Targets Major GitHub Repositories An AI-powered bot, known as hackerbot-claw, executed a week-long attack on CI/CD pipelines of major open-source GitHub repositories, leading to remote code execution vulnerabilities. The attack compromised at least five repositories, including Project-akri, through direct script injection methods. The incident highlights the growing sophistication of automated cyber threats in software development environments. 9 sources 47

Extracted Entities

Attack Types (1)

Supply Chain Attack

Campaigns (1)

Operation Review

MITRE ATT&CK (1)

T1195 - Supply Chain Compromise

Tools (1)