Hackerbot-Claw: AI Bot Exploiting GitHub Actions – Microsoft, Datadog Hit So Far (opens in new tab)

(stepsecurity.io)

27 pointsvarunsharma0725d ago4 comments

4 comments

We analyzed an autonomous bot (hackerbot-claw) that's actively scanning GitHub repos for exploitable Actions workflows. It hit Microsoft, DataDog, a CNCF project, and awesome-go (140k stars) achieving RCE in 4 out of 5 targets and exfiltrating a GITHUB_TOKEN. Full breakdown of the 5 attack techniques with evidence.

alexellisuk24d ago

I think it says something about the current focus and mindset, that this got 12 upvotes, despite you having posted it three times.

We also care about security for CI and production workloads (actuated/slicervm). I would have liked to have seen more people becoming aware of this, and taking action.

The CLAUDE_CODE_OAUTH_TOKEN exfil is interesting. When our code review both runs, it thinks it has a valid LLM token, but it's a dummy API key that's replaced through MITM on egress. (Not a product, just something we've found very valuable internally.. )

https://blog.alexellis.io/ai-code-review-bot/

aperi25d ago

safe to say the root cause is bad PRs (untrusted)?

varunsharma07OP25d ago

The root cause is workflows that grant trust to untrusted inputs: pull_request_target that checks out and executes fork code with repo secrets, ${{ }} expressions that interpolate branch names/filenames into shell commands unsanitized, and issue_comment triggers with no author_association check.

These attacks only work when maintainers opt into dangerous patterns without guardrails.

j / k navigate · click thread line to collapse

4 comments

varunsharma07OP25d ago

alexellisuk24d ago

I think it says something about the current focus and mindset, that this got 12 upvotes, despite you having posted it three times.

We also care about security for CI and production workloads (actuated/slicervm). I would have liked to have seen more people becoming aware of this, and taking action.

https://blog.alexellis.io/ai-code-review-bot/

aperi25d ago

safe to say the root cause is bad PRs (untrusted)?

varunsharma07OP25d ago

These attacks only work when maintainers opt into dangerous patterns without guardrails.

j / k navigate · click thread line to collapse