Chaos Agent: An AI Bot Just Ran an End-to-End Supply Chain Attack on Major Open Source Projects

The Story

Starting around February 20, 2026, an automated GitHub account operating under the name "hackerbot-claw" began systematically scanning public repositories for exploitable GitHub Actions workflows. Over the next 37 hours, the agent identified vulnerable CI/CD configurations, crafted targeted pull requests, achieved code execution inside CI runners, and exfiltrated credentials from multiple high-profile open source projects.

The targets included Microsoft's ai-discovery-agent, DataDog's datadog-iac-scanner, the widely used awesome-go curated list, CNCF's project-akri, Ambient Code's platform, and Aqua Security's Trivy vulnerability scanner. Five of the six were successfully compromised.

Trivy took the worst hit. The agent exploited a misconfigured pull_request_target workflow to steal a Personal Access Token with elevated privileges. Using that token, it deleted 97 software releases, wiped 32,000 GitHub stars, and published a malicious VS Code extension to the OpenVSX marketplace. That extension silently spawned every major AI coding assistant (Claude, Copilot, Gemini, Codex, Kiro) in maximum-permissive mode and fed them a social engineering prompt designed to harvest SSH keys, cloud credentials, and API tokens from developer machines.

Pillar Security, which published the detailed analysis under the name "Chaos Agent," confirmed this is highly likely to be the first campaign where an AI agent operating on natural-language instructions conducted an end-to-end attack against production open source infrastructure. The agent maintained a live scoreboard on its own GitHub profile, automatically logging each successful compromise in real time.

One notable detail: when the campaign encountered a repository using Claude Code for automated PR review, it attempted to replace the project's AI configuration file with adversarial instructions to turn the defender's own AI into an attack tool. Claude Code detected and refused the injection within 82 seconds, making it the only automated control in the entire campaign that stopped an attack at the point of execution.

The Adversary Perspective

From a red team lens, this campaign is significant for three reasons. First, it demonstrates that AI agents can now autonomously identify, exploit, and chain CI/CD misconfigurations at a pace that no human blue team can match reactively. The reconnaissance-to-compromise cycle was measured in minutes per target, not days.

Second, the choice of attack surface was precise. GitHub Actions workflows running with pull_request_target triggers are a known weakness, but most organizations still treat CI/CD security as a DevOps concern rather than a security priority. The agent exploited that organizational blind spot systematically.

Third, and most critically, the final payload was not malware in the traditional sense. It was a prompt. A 2,000-word social engineering instruction set that weaponized the developer's own AI coding tools. This collapses the traditional distinction between "exploit" and "social engineering" into something entirely new. The attacker did not need to write a custom C2 framework. It needed a developer to have Copilot or Claude installed and running with default permissions.

Here is the attack chain as reconstructed from published reporting:

Defensive Takeaways