Industry Newsgithub actionsci cdsupply chainrce
Autonomous Bot Exploits GitHub Actions Workflows
9.1
Relevance Score
An autonomous AI account, hackerbot-claw, ran a week-long campaign from Feb 21–28, 2026 exploiting GitHub Actions misconfigurations to gain RCE and full repository compromise in projects including Microsoft, DataDog, and Aqua Security. The bot abused pull_request_target workflows, shell interpolation, and poisoned CLAUDE.md files to exfiltrate a Personal Access Token and push malicious commits. Vendors revoked credentials and patched workflows, highlighting CI/CD supply-chain risks.
