When an AI Agent Came Knocking: Catching Malicious Contributions

Christoph Hamsen, Kylian Serrania and Christophe Tafani-Dereeper on catching an attacker who was using an LLM to scale up malicious open source contributions. Their framing of why they answered in kind:

Malicious actors are adopting LLMs to guide and scale their operations, and we as defenders must also use them to keep pace.

The tool is BewAIre. It watches GitHub events, picks the security-relevant ones, extracts and normalises the diff, enriches it with context, and passes it to a two-stage LLM pipeline that calls the change benign or malicious with a written rationale. Malicious verdicts go to Cloud SIEM as signals for triage. The volume it exists to handle is close to 10,000 pull requests a week.

The incident ran on 27 February 2026. An actor calling itself hackerbot-claw opened a pull request on datadog-iac-scanner at 5:26 UTC, hiding shell commands with ${IFS} substitution to get around space filtering; the decoded payload piped a remote script into bash. A second attempt followed at 5:44, then around 7:28 two issues on datadog-agent carrying prompt injection aimed at the Claude code action. Across the campaign it opened 16 PRs and 2 issues over 9 repositories and 6 organisations. BewAIre alerted within seconds of the first PR, and nothing landed: branch protections held, token scoping limited the blast radius, the Claude action refused the injection, and no secrets leaked.

The part worth carrying is the layering rather than the catch. Detection was one of several things that had to fail before this worked, which is the authors’ own point about combining proactive detection with strict privilege scoping. The prompt injection numbers are a useful reality check too: measured success rates of 21.7% against Opus 4.6, 40.7% against Sonnet 4.5 and 58.4% against Haiku 4.5, at a time when more than 10,000 public workflows were running that action. Same day as their harness-first piece, and the pair read as two halves of one position: verify what agents write, and assume some of the agents are hostile.