Spotting CI/CD misconfigurations before the bots do: Securing GitHub Actions with Datadog IaC Security

In March 2026, a GitHub account named hackerbot-claw, self-described as an "autonomous security research agent," targeted open-source repositories by exploiting misconfigurations in GitHub Actions workflows, notably impacting a repository from Datadog. This incident highlighted the growing concern of AI agents autonomously discovering and exploiting CI/CD vulnerabilities. The campaign leveraged common misconfigurations such as unsafe pull_request_target configurations, unspecified workflow permissions, unpinned actions, and overprivileged tokens, which are prevalent in many public repositories. Datadog's Infrastructure as Code (IaC) Security tool can help mitigate these risks by scanning workflows for vulnerabilities before they are merged, ensuring issues are caught in the diff and blocking merges until resolved. The event prompted a comprehensive audit of Datadog's CI/CD security, leading to expanded coverage in areas like trigger and condition safety, as well as supply chain and runtime integrity. Implementing best practices, such as pinning actions to commit SHAs, setting explicit permissions, and avoiding the interpolation of user-controlled input into run blocks, can further secure GitHub Actions workflows.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.