AI-driven actor ran six waves of GitHub pull_request_target abuse
A single attacker used AI automation to run six distinct waves of malicious pull_request_target exploits on GitHub starting March 11, 2026, weeks before public disclosure. This campaign produced over 500 malicious pull requests and compromised at least two npm packages. The attacker evolved payloads from simple scripts to AI-generated, language-aware code, increasing stealth and adaptability. This reveals that the threat is persistent and scalable, not a one-off burst. Any repository exposing secrets or privileged workflows to untrusted pull requests via pull_request_target is at risk of supply-chain compromise, including poisoned packages and stolen tokens. Standard remediation steps miss the persistence of published artifacts and the rapid retry capability enabled by AI tooling. This campaign demands urgent operational response to remove secrets and convert sensitive workflows to trusted contexts.
PRT-scan is the second campaign in recent months where a threat actor has leveraged AI for automated targeting of a widespread GitHub misconfiguration.
prt-scan: AI-Powered GitHub Actions Supply Chain Attack | Wiz Blog
Wiz Research traces six waves of pull_request_target exploitation to one actor, starting three weeks before public disclosure. 500+ malicious PRs, 10% success.