When an AI agent came knocking: Catching malicious contributions in Datadog’s open source repos | Datadog

This post details how Datadog's BewAIre system detected and defended against the 'hackerbot-claw' AI agent, which attempted to exploit CI-related vulnerabilities in open-source repositories. It highlights the evolution of defensive strategies to counter AI-driven attacks, including prompt injection detection against LLM-powered actions and hardening CI/CD workflows against indirect poisoned pipeline execution and insecure variable interpolation. The post also emphasizes the importance of integrating security findings into SIEM and incident response processes, and outlines ongoing efforts in secure SDLC practices like dynamic credential generation and enforcing CI security best practices.