When an AI agent came knocking: Catching malicious contributions in Datadog’s open source repos

Datadog describes how AI-powered attackers targeted its open-source repositories through malicious issues, pull requests, and comments. The campaign, attributed to the “hackerbot-claw” agent, focused on weaknesses in GitHub Actions and LLM-powered workflows. Datadog’s LLM-based review system and layered CI security controls detected the activity and helped limit its impact, while prompting further hardening.

Why Open-Source Repositories Attract Attackers

• Public repositories are attractive targets because automated CI/CD pipelines often build and execute code from external contributions.
• Common attack techniques include:
  • Injecting user-controlled values, such as PR titles, into workflow scripts.
  • Using indirect poisoned pipeline execution to introduce malicious dependencies or build instructions.
  • Abusing pull_request_target workflows, which may run untrusted code with elevated permissions.
  • Prompt-injecting LLM-powered GitHub Actions used for issue triage, labeling, or code assistance.
• Attackers may also disguise malicious changes through:
  • Large or obfuscated diffs.
  • Invisible Unicode characters.
  • Malicious libraries.
  • Imposter commits that resemble legitimate dependency references.

Datadog’s LLM-Based Contribution Detection

• Datadog receives dozens of external PRs each week across projects such as the Agent, tracers, SDKs, Vector, chaos-controller, and Stratus Red Team.
• Its BewAIre system monitors GitHub events and selects security-relevant activity, including PRs and pushes.
• BewAIre:
  • Extracts, normalizes, and enriches code diffs.
  • Sends them through a two-stage LLM pipeline.
  • Classifies changes as benign or malicious.
  • Produces a structured explanation for each verdict.
• Malicious verdicts are forwarded to Datadog Cloud SIEM, where detection rules create enriched signals for the Security Incident Response Team to investigate.

Hardening CI and Development Workflows

• Datadog reduces the potential impact of successful attacks through multiple preventive controls:
  • Its dd-octo-sts-action generates minimally scoped, short-lived GitHub credentials using OIDC.
  • Long-lived and overly broad personal access tokens and GitHub Apps are being replaced.
  • Unused GitHub Actions secrets are identified and removed across thousands of repositories.
  • Organization-wide controls enforce branch protection, mandatory PR approval, commit signing, and lower-privilege default GITHUB_TOKEN permissions.
  • Engineers are provided with documented best practices and secure “golden paths” for CI development.

The Hackerbot-Claw Campaign

• Modern AI models are increasingly capable of offensive security tasks, especially when given tools, feedback loops, and autonomy.
• StepSecurity reported an AI agent attacking open-source CI systems on March 1.
• Between February 27 and March 2, the actor:
  • Opened 16 pull requests.
  • Created two issues and eight comments.
  • Targeted nine repositories across six organizations.
• The activity was later linked to the hackerbot-claw agent, whose GitHub account was removed.
• Datadog’s investigation began after BewAIre alerted the team to a suspicious contribution in the newly public datadog-iac-scanner repository on February 27.

Practical Takeaway

Organizations that accept public contributions should combine automated, AI-assisted review with least-privilege credentials, strict workflow permissions, secret management, mandatory approvals, and human incident response. Detection alone is insufficient; CI pipelines should be designed so that a malicious contribution has limited access and minimal opportunity to compromise secrets or production systems.