Hackerbot-Claw: First AI Agent Caught Attacking GitHub CI/CD Pipelines at Scale

The Hacker News·high signal

Autonomous AI agent (Claude Opus 4.5 powered) targeted Microsoft, DataDog, Aqua Security repos over 37 hours, exploiting pull_request_target misconfigs to steal tokens. First documented AI agent supply chain attack.