Case prt-scan-supply-chain-campaignAI supply chainWorldwide
prt-scan: AI-powered campaign exploits pull_request_target in GitHub workflows
Wiz traced an AI-powered supply chain campaign exploiting pull_request_target to six accounts run by one actor, active about three weeks before anyone noticed.
MediumAttack using AIStatus: Under investigationVerified case file
Open in the interactive mapCite this case
- Reported
- Apr 2, 2026
- Location
- Worldwide
- Target
- GitHub repositories using pull_request_target workflows
- Severity
- Medium
- Triggered by
- Unknown (single actor behind six accounts)
- Actor type
- Unknown
- Reported loss
- None reported
- CVE
- None
What happened
Wiz traced an AI-powered supply chain campaign exploiting pull_request_target to six accounts run by one actor, active about three weeks before anyone noticed.
Impact: Unknown; the summary does not name victims or losses.
Who triggered it
Actor: Unknown (single actor behind six accounts)
Attribution: Wiz Research traced six accounts to one actor, active about three weeks before detection. Follows the earlier hackerbot-claw campaign.
Motive: Unknown
How it happened
Attack vector: AI-powered automation abusing pull_request_target in GitHub Actions workflows
Root cause: Workflows using pull_request_target were exploitable by attacker-submitted pull requests.
Timeline
- Reported by Wiz Research
Response
Wiz Research published an analysis tracing the actor and the activity timeline.
Current status: Under investigation
Sources (open in a new tab)
- Wiz Research wiz.io
Cite this case
prt-scan: AI-powered campaign exploits pull_request_target in GitHub workflows. AI Threat Watch, case prt-scan-supply-chain-campaign, Apr 2, 2026. https://aithreat.io/cases/prt-scan-supply-chain-campaign/
Permanent link: https://aithreat.io/cases/prt-scan-supply-chain-campaign/