Clean GitHub Repo Tricks AI Coding Agents into Running Malware
Mozilla researchers demonstrate a technique where a clean-looking GitHub repository tricks AI coding agents into executing hidden malware via a three-step indirection chain.
Researchers at Mozilla's Zero Day Investigative Network (0DIN) have demonstrated a novel attack technique that tricks AI coding agents into executing malware from a seemingly benign GitHub repository. The attack exploits the trust AI agents place in setup instructions and error messages, requiring no malicious code in the cloned repository itself.
The attack relies on three components that individually appear harmless. A clean GitHub repository includes standard setup instructions like pip3 install -r requirements.txt and python3 -m axiom init. The Python package is intentionally designed to refuse execution until initialized, generating an error that instructs the user to run python3 -m axiom init. Claude Code, treating this as a normal setup issue, automatically executes the suggested command. That command calls a shell script that retrieves a configuration value from a DNS TXT record controlled by the attacker, which is then executed as a command.
"Claude Code never decided to open a shell. It decided to fix an error. The reverse shell is three indirection steps away from anything Claude Code actually evaluated: an error message it trusted, a script that fetched a value, and a DNS record it never saw," the researchers explained. If successful, the attacker obtains an interactive shell running with the developer's privileges, granting access to environment variables, API keys, and local configuration files, and the ability to establish persistence.
While currently a proof of concept, the technique could be weaponized by threat actors distributing malicious repositories through fake job postings, tutorials, blog posts, or direct messages. The attack targets agentic coding environments where AI tools automate setup and execution, bypassing both human review and security scanners.
To mitigate such attacks, 0DIN recommends that AI agents disclose the full execution chain of setup commands, including scripts and code fetched dynamically at runtime. The research highlights a growing supply-chain risk as developers increasingly rely on AI coding agents to clone, set up, and run code from external repositories.
This attack vector is distinct from traditional supply-chain attacks because it exploits the AI agent's behavior rather than injecting malicious code into the repository. It underscores the need for security controls that account for the unique trust dynamics in AI-assisted development workflows.
Mozilla researchers have expanded on the threat, detailing how malicious GitHub repositories can exploit AI coding agents like Claude Code through indirect prompt injection. This attack vector manipulates the AI into executing unauthorized actions by processing malicious instructions embedded within seemingly innocuous external data, such as setup instructions, without requiring any malicious code to be present in the repository itself.
This new research details a specific method for achieving the described attack, where attackers hide indirect prompts within seemingly harmless code repositories. When Claude Code processes these prompts, it can spawn a reverse shell on the developer's machine by exploiting an error during installation and a subsequent DNS TXT record lookup, enabling attackers to gain control.
This new report indicates that traditional Bash shell tricks, a technique dating back decades, can bypass security measures in AI coding agents. This expands on previous findings by demonstrating a broader class of vulnerabilities that can be exploited through malicious code repositories, turning them into supply chain attack vectors for AI development workflows.
This new research from the AI Now Institute details a 'Friendly Fire' attack that specifically targets AI coding agents like Anthropic's Claude Code and OpenAI's Codex when operating in autonomous modes. Unlike previous demonstrations that might rely on specific configuration files or indirect prompt injection, this attack embeds a malicious script within a README.md file, disguised as a legitimate security check. The researchers highlight that the vulnerability lies in the design of these autonomous agents, which can be tricked into executing attacker-controlled code by mistaking it for part of the code review process, even when the code appears to be compiled from a harmless source file.