Breaking

Researchers Show How a Clean GitHub Repo Can Make AI Coding Agents Run Malware

June 27, 2026 at 10:24 EDT

Security
AI Agents
Software Dev & Coding

Researchers at Mozilla's AI security platform 0DIN (Zero Day Investigative Network) have demonstrated an attack that uses a "clean" GitHub repository containing no malicious code to make Anthropic's AI coding agent Claude Code launch a reverse shell on a developer's machine. Reported on June 27, 2026, the technique is a proof of concept that manipulates the agent through indirect prompt injection, with no large-scale real-world damage reported so far.

June 25, 2026 · 0DIN Security Research

A "Clean" Repo With No Malware — Yet Your AI Agent Hands Over a Shell

A proof of concept makes AI coding agents like Claude Code execute a reverse shell from a GitHub repository that contains zero malicious code — the payload is fetched at runtime from a DNS record, invisible to scans and review.

lines of malicious code stored in the repository

DNS

TXT record delivers the base64 payload at runtime

:4443

attacker port for the interactive reverse shell

The attack chain — the AI agent completes it

1 · Clean repo

Standard README & pip install — passes scans & review

→

2 · Fake error

Setup raises an error: "Run: python3 -m axiom init"

→

3 · DNS fetch

dig TXT … | bash pulls a hidden reverse-shell payload

→

4 · Shell

Agent treats it as "normal recovery" & runs it — attacker gets a shell

What the shell reaches — developer-level access

Interactive access under the developer's own privileges exposes high-value secrets:

ANTHROPIC_API_KEY AWS_SECRET_ACCESS_KEY GITHUB_TOKEN config files persistence

⚠ The structural problem

AI agents hold broad tool permissions — shell execution, file access, network calls. Trusted "error fixes" become a vector for indirect prompt injection.

✓ Mitigation

Require agents to disclose the full execution chain — including scripts and dynamically fetched artifacts — and verify setup steps manually, even when an AI recommends them.

Status: Proof of concept only — no real-world exploitation confirmed. What sets it apart from earlier supply-chain attacks: it places no malicious code in the repository at all.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.