hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft, DataDog, and CNCF Projects Hit So Far

An AI-powered autonomous bot called hackerbot-claw conducted a week-long automated attack campaign targeting CI/CD pipelines in major open source repositories including Microsoft, DataDog, and CNCF projects. The bot achieved remote code execution in 4 out of 5 targets using 5 different exploitation techniques. Successfully exfiltrated a GitHub token with write permissions from one of GitHub's most popular repositories. The campaign demonstrates advanced AI-driven automated exploitation of GitHub Actions workflows in CI/CD environments.