ghtier
← Back to Organization plane incidents
OrganizationFebruary 2026

hackerbot-claw autonomous agent RCE

An autonomous agent doing this at scale. It abused unsafe pull_request_target, unsanitized inputs, dynamic shell execution, and overprivileged GITHUB_TOKEN to get RCE on GitHub-hosted runners across at least six repositories, exfiltrating write-capable tokens in some cases. Targets included Trivy, avelino/awesome-go, microsoft/ai-discovery-agent, DataDog/datadog-iac-scanner, project-akri/akri, RustPython, and ambient-code/platform, where the vector was prompt injection via CLAUDE.md, which was blocked. On Trivy it stole a PAT through a pull_request_target workflow and used it to take over the repository.

Permissions abused

Unsafe pull_request_targetOverprivileged GITHUB_TOKENPAT exfiltration

On the permission reference

T2Contents: Write

Sources

How it unfolded

  1. 1

    Public repositories are scanned at scale

    Over a single week (February 21–28, 2026), an autonomous, AI-driven bot systematically scanned public GitHub repositories for exploitable CI/CD workflow patterns, rather than hand-picking one victim.

  2. 2

    Vulnerable patterns are matched automatically

    The bot classified targets by which of five exploitation techniques applied — unsafe pull_request_target, unsanitized inputs, dynamic shell execution, or an overprivileged GITHUB_TOKEN among them — and applied the matching attack per repository.

  3. 3

    A crafted pull request gets code execution on a hosted runner

    Where pull_request_target combined with unsanitized input reaching a shell, a single PR was enough to achieve remote code execution on a GitHub-hosted runner in that repository's privileged context.

  4. 4

    Write-capable tokens are exfiltrated

    Running with an overprivileged GITHUB_TOKEN, the bot exfiltrated write-capable tokens from at least six repositories, including Trivy, awesome-go, and projects at Microsoft, DataDog, and the CNCF.

  5. 5

    A stolen token is reused for outright takeover

    On Trivy specifically, the exfiltrated PAT was reused to take over the repository. On another target, a prompt-injection attempt via CLAUDE.md was blocked before it could do damage.

Mitigations

  • Require approval for first-time/external contributor workflow runs on forks — a single PR can't auto-execute

  • Audit every use of pull_request_target — remove or restructure any that also check out and run the PR's own code

  • Set the default GITHUB_TOKEN permission to read-only at the org level

  • Sanitize any PR-controlled input (titles, branch names, file contents) — before it can reach a shell command

  • Treat repository files an autonomous coding agent might read (CLAUDE.md, AGENTS.md, etc.) as untrusted input — if such an agent runs against the repo

Frameworks

CICD-SEC-4CICD-SEC-5CICD-SEC-1NIST 5.1.2

Part of

Contained. First seen February 2026. Mapping by ghtier, not yet reviewed. Threat landscape