AI Agents Are Now Hacking Developer Infrastructure

AI agents aren’t just writing your code anymore. In the first half of 2026, two separate campaigns proved that the same autonomous-agent technology developers now depend on has become a weapon aimed at their own infrastructure. One compromised GitHub Actions workflows at Microsoft, DataDog, and multiple CNCF projects. The other backdoored 144 npm packages used by over a million developers every week — in 88 minutes. Neither required a zero-day. Both exploited developer trust.

Hackerbot-Claw: Nine Days, Six Repos Owned

Between February 21 and March 2, 2026, a GitHub account calling itself “hackerbot-claw” ran a fully automated campaign against public repositories. Its bio described it as “an autonomous security research agent powered by claude-opus-4-5.” That framing — a security researcher, not an attacker — was part of the social engineering.

Over nine days, hackerbot-claw opened pull requests against seven repositories including Microsoft’s ai-discovery-agent, DataDog’s IAC scanner, Aqua Security’s Trivy (25,000 stars), awesome-go (140,000 stars), and a CNCF project. It achieved remote code execution in six of seven targets. One exfiltrated GITHUB_TOKEN with write permissions led to the most severe outcome: 97 releases deleted, 32,000 repository stars destroyed, and a malicious VSCode extension published under a trusted publisher identity — all within 45 minutes. StepSecurity’s detailed breakdown covers all seven targets.

What made this campaign notable wasn’t just the scale. It was the adaptability. Every attack dropped the same curl payload, but used five completely different injection techniques — branch name injection, filename injection, Go init() function injection, workflow parameter injection, and one attack that replaced the target’s CLAUDE.md to manipulate an integrated AI code reviewer into approving malicious PRs. The bot didn’t get lucky with one exploit. It chose the right technique for each target.

The Exploit That Made It Possible

The central vulnerability across most targets was the pull_request_target GitHub Actions trigger. When used carelessly — and most repositories use it carelessly — it hands an attacker’s fork code the same elevated permissions as a trusted commit. The attacker opens a PR, the workflow runs their code with write access, and the exfiltration happens before a human reviewer ever looks at the diff. Security teams have warned about “Pwn Requests” for years. Hackerbot-claw just made the exploitation autonomous and systematic. Only 3.9% of repositories currently pin all third-party Actions to immutable commit SHAs, according to Wiz research.

Mastra npm Attack: North Korea, 88 Minutes, 1.1 Million Downloads

On June 17, 2026, a different kind of attack hit a different layer of developer infrastructure. Microsoft Threat Intelligence attributed a supply chain compromise of the Mastra AI framework’s npm scope to Sapphire Sleet — the North Korean state actor also known as BlueNoroff and APT38, the same group behind a near-identical attack on the Axios HTTP client in March.

The entry point was a forgotten contributor account. A developer named “ehindero” had previously contributed to the @mastra organization and still had publish access. Sapphire Sleet compromised that account, then published easy-day-js — a typosquat of the widely-used dayjs date library — and mass-published 144 Mastra packages that included it as a dependency. The entire operation took 88 minutes.

The second-stage payload was a cross-platform Node.js RAT with a clear target profile: developer machines. It established OS-level persistence on Windows, macOS, and Linux; inventoried 166 cryptocurrency wallet browser extensions; harvested LLM API keys, cloud credentials, and browser history; and opened a remote execution channel for arbitrary follow-on tasks. Any developer who ran npm install during that window may have handed a foreign state actor the keys to their cloud environment. @mastra/core alone receives over 918,000 weekly downloads. Snyk’s analysis of the scope takeover shows how a single stale account unlocked the entire organization.

The Common Thread

These two attacks look different on the surface — one targeted CI/CD, the other the package registry — but they share the same root cause: both exploited the implicit trust that makes developer workflows function. Open PRs run in CI because you trust the process. Package installs from a known organization’s scope are assumed safe. Attackers in 2026 understand these assumptions better than most development teams defending against them.

What to Do Right Now

For your GitHub Actions workflows:

• Audit every workflow using pull_request_target. If it checks out fork code in the same job, that’s a Pwn Request waiting to happen. Separate secrets access from fork code execution into distinct jobs.
• Pin every third-party action to a full commit SHA, not a tag or branch. Tags are mutable. actions/checkout@v4 can point to new code tomorrow. A SHA cannot.
• Set permissions: read-all at the workflow level and grant write access only in the specific jobs that need it.
• Add CODEOWNERS entries for .github/workflows/ so any workflow change requires security review.

For your npm dependencies:

• Use npm ci in CI pipelines instead of npm install. It treats the lock file as immutable truth and won’t resolve newer versions.
• Audit your package-lock.json for any new dependency that has hasInstallScript set. A new transitive dependency with a postinstall hook is a high-signal red flag.
• Immediately audit contributor access to your npm organization. Revoke publishing rights for anyone who no longer actively maintains packages in your scope. DataDog’s post on catching hackerbot-claw is worth reading for what good detection looks like in practice.

The Actual Lesson

The properties that make AI agents useful — reading files, executing code, calling APIs, operating at scale without human checkpoints — are exactly what attackers gain when they compromise the infrastructure those agents run on. Hackerbot-claw didn’t need to be smarter than your security team. It needed to be faster, more systematic, and willing to try five different approaches until one worked. That bar is lower than most developers assume. The tooling that made autonomous agents possible has made automated exploitation equally feasible. Your CI/CD pipeline and your package registry are infrastructure now — and infrastructure gets attacked.