Researchers at Mozilla's Zero Day Investigative Network (0DIN) demonstrated an attack method where an agentic coding tool executes a malicious payload after cloning a benign GitHub repository. This compromise occurs without exploit code, warnings, or suspicious commands requiring approval.

The attack method relies on a clean-looking GitHub repository with standard setup instructions. 0DIN researchers used Claude Code to run a cloned project that did not contain malicious code within the repository itself. The AI agent, designed to automate the entire attack chain, also mimicked a common user error during the process.

The attack involves a Python package that generates an error when it refuses execution until initialized. This error prompts the user to run a specific command. Claude Code then automatically runs this suggested initialization command while attempting to recover from the error. Executing this command calls a shell script that retrieves a configuration value from a DNS TXT record controlled by an attacker. The value obtained from the DNS TXT record is then executed as a command.

If successful, this process grants the attacker a shell operating with the developer's privileges. This access provides the attacker with information such as environment variables, API keys, and local configuration files. The attack also creates an opportunity for the attacker to establish persistence.

"Claude Code never decided to open a shell. It decided to fix an error. The reverse shell is three indirection steps away from anything Claude Code actually evaluated: an error message it trusted, a script that fetched a value, and a DNS record it never saw," 0DIN researchers said. They added, "The attacker now has an interactive shell running as the developer's own user."

This attack method is currently a concept. 0DIN warns that threat actors could distribute such GitHub repositories through fake job postings, tutorials, blog posts, or direct messages. 0DIN suggests that AI agents should disclose the full execution chain of setup commands, including scripts and code fetched dynamically at runtime.