{
 "public_id": "AIR-2026-0057",
 "incident_id": "2026-03-pillar-hackerbot-claw-campaign",
 "date_disclosed": "2026-03-03",
 "date_occurred": "2026-02-20",
 "title": "Hackerbot-Claw: an AI-augmented actor compromises Trivy and other repos via pull_request_target, deletes 97 releases and ships a credential-stealing OpenVSX extension",
 "class": "in_the_wild",
 "attack_surface": "coding_agent",
 "initial_vector": "ci_cd_misconfiguration_and_malicious_extension",
 "agent_capability_abused": [
  "ci_workflow_execution",
  "ai_code_reviewer_injection",
  "agent_permission_bypass_flags",
  "shell_execution"
 ],
 "target_product": "Trivy (Aqua Security), Microsoft ai-discovery-agent, DataDog datadog-iac-scanner, awesome-go, CNCF akri, ambient-code platform; OpenVSX marketplace",
 "target_vendor": "multiple",
 "autonomy_level": "fully_autonomous",
 "impact_realized": true,
 "impact_type": [
  "destructive_action",
  "credential_theft",
  "supply_chain_compromise"
 ],
 "blast_radius": "six named open-source projects; 97 Trivy releases deleted; extension published to OpenVSX",
 "cve": [
  "CVE-2026-28353"
 ],
 "taxonomy": {
  "owasp_asi": [
   "ASI05",
   "ASI01",
   "ASI04"
  ],
  "mitre_atlas": [],
  "labels": [
   "pull_request_target",
   "ai_assisted_attacker",
   "malicious_vscode_extension",
   "agent_as_exfil_tool",
   "ai_code_reviewer_bypass"
  ]
 },
 "defense_present": "AI code reviewers; marketplace review",
 "defense_bypassed": true,
 "fix_shipped": "n/a - campaign response",
 "primary_sources": [
  "https://www.pillar.security/blog/hackerbot-claw-adversarial-agent-targets-top-github-repos"
 ],
 "verified_quote": "Within 37 hours, hackerbot-claw identified vulnerable open-source projects, crafted targeted exploits, compromised CI/CD pipelines, and published a malicious extension.",
 "confidence": "high",
 "notes": "Pillar Security (Eilon Cohen). Campaign ran 2026-02-20 to 2026-03-01. Two things make this a landmark record: the attacker used AI agents offensively at speed (Trivy compromised in 45 minutes), and the exfiltration tool was the victim's own assistant - 'The exfiltration tool wasn't malware. It was the developer's own AI assistant, following instructions.' Pillar also reports Claude Code refused the injection in 82 seconds, the only control that stopped an attack at execution. Confirmed victim machines for CVE-2026-28353 remain unconfirmed.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Supply Chain Compromise",
 "risk_sub_secondary": [
  "Credential & Secret Theft"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the AI code reviewer was injected and the agent executed CI actions",
 "vector_family": "malicious_component",
 "vector_detail": "ci_cd_misconfiguration_and_malicious_extension",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [
   "CVE-2026-28353"
  ],
  "ghsa": []
 },
 "primary_asi": "ASI05",
 "agent_framework": "unknown",
 "model_provider": "microsoft",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "supply_chain_vulnerabilities",
 "eai_domain": "tool_misuse",
 "eai_secondary": [
  "unsafe_actuation",
  "credential_theft"
 ],
 "eai_reason": "subcategory: Supply Chain Compromise",
 "asi_curated": [
  "ASI05",
  "ASI01"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI05,ASI01 | added ASI04 (vector_family=malicious_component)",
 "submitted_by": "EAI Internal"
}