In the wild
Realized harm
Hackerbot-Claw: an AI-augmented actor compromises Trivy and other repos via pull_request_target, deletes 97 releases and ships a credential-stealing OpenVSX extension
AIR-2026-0057 AIR record · 2026-03-pillar-hackerbot-claw-campaign
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
Within 37 hours, hackerbot-claw identified vulnerable open-source projects, crafted targeted exploits, compromised CI/CD pipelines, and published a malicious extension.pillar.security
The record
Disclosed
2026-03-03
Occurred
2026-02-20
Vendor
multiple
Product
Trivy (Aqua Security), Microsoft ai-discovery-agent, DataDog datadog-iac-scanner, awesome-go, CNCF akri, ambient-code platform; OpenVSX marketplace
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Unsafe actuation, Credential theft
System type
Generative model
Who acted
Agent acted — the AI code reviewer was injected and the agent executed CI actions
Attack surface
Coding agent
Autonomy level
Fully autonomous
Initial vector
Ci cd misconfiguration and malicious extension
Impact type
Destructive action, Credential theft, Supply chain compromise
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
six named open-source projects; 97 Trivy releases deleted; extension published to OpenVSX
Capability abused
Defense & remediation
Recorded defense
AI code reviewers; marketplace review
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
n/a - campaign response
Taxonomy & references
Curator notes
Pillar Security (Eilon Cohen). Campaign ran 2026-02-20 to 2026-03-01. Two things make this a landmark record: the attacker used AI agents offensively at speed (Trivy compromised in 45 minutes), and the exfiltration tool was the victim's own assistant - 'The exfiltration tool wasn't malware. It was the developer's own AI assistant, following instructions.' Pillar also reports Claude Code refused the injection in 82 seconds, the only control that stopped an attack at execution. Confirmed victim machines for CVE-2026-28353 remain unconfirmed.
Supporting sources
Cite as
Enkrypt AI. "Hackerbot-Claw: an AI-augmented actor compromises Trivy and other repos via pull_request_target, deletes 97 releases and ships a credential-stealing OpenVSX extension". AIR, AIR-2026-0057. https://agentincident.vercel.app/i/AIR-2026-0057/ (accessed 2026-10-19).