Security researchers have demonstrated a new attack technique that could trick AI coding agents into executing hidden malware, even when a GitHub repository appears completely legitimate.
Researchers at Mozilla’s Zero Day Investigative Network (0DIN) say the method exploits how AI-powered coding assistants automatically troubleshoot software installation problems. Instead of relying on malicious code inside a repository, attackers can manipulate trusted setup steps to convince an AI agent to execute a harmful payload.
The researchers tested the technique against Claude Code, showing how an attacker could gain an interactive shell on a developer’s machine without placing malicious code in the cloned GitHub repository itself.
AI Agents Can Trigger the Entire Attack Chain
According to 0DIN, the attack requires three seemingly harmless components that become dangerous only when combined.
The first component is a clean-looking GitHub repository containing ordinary installation instructions such as installing dependencies and initializing a project.
Next, the supplied Python package deliberately refuses to run until the user executes an initialization command. When Claude Code encounters the resulting error, it interprets the message as a routine setup problem and automatically runs the recommended command while attempting to fix the issue.
That command launches a shell script that retrieves a configuration value stored inside an attacker-controlled DNS TXT record before executing it as a system command.
Because the malicious payload never appears directly inside the GitHub repository, traditional code reviews and many security tools may never detect the attack.
No Exploit Code Required
The researchers say the technique does not rely on software vulnerabilities or exploit code.
Instead, it abuses normal development workflows and the willingness of AI coding agents to resolve installation errors automatically.
“Claude Code never decided to open a shell. It decided to fix an error,” the researchers explained.
“The reverse shell is three indirection steps away from anything Claude Code actually evaluated: an error message it trusted, a script that fetched a value, and a DNS record it never saw.”
By following what appears to be a legitimate troubleshooting process, the AI agent unknowingly completes every stage of the attack.
Successful Attack Could Expose Developer Systems
If the attack succeeds, the attacker gains an interactive shell running under the developer’s user account.
That level of access could expose environment variables, API keys, local configuration files, authentication tokens, and other sensitive development assets. Attackers could also establish persistence or move deeper into the victim’s environment.
Because the compromise occurs during a routine project setup, developers may never realize their AI assistant initiated the attack.
Fake GitHub Projects Could Deliver the Attack
Although researchers describe the technique as a proof of concept, they warn that threat actors could easily adapt it for real-world campaigns.
Attackers could distribute seemingly legitimate GitHub repositories through fake job offers, programming tutorials, blog posts, open-source projects, or direct messages targeting developers.
The attack relies on social engineering rather than exploiting a software vulnerability, making it difficult to detect using traditional security controls.
Mozilla Recommends Greater Transparency
To reduce the risk of similar attacks, 0DIN recommends that AI coding agents clearly disclose every step they plan to execute during project setup.
Researchers say developers should see not only the commands an AI assistant runs but also any scripts, external resources, or dynamically retrieved content those commands invoke before execution.
Providing full visibility into the execution chain would make it significantly harder for attackers to hide malicious actions behind seemingly routine installation instructions.
FAQ
How does the GitHub AI coding agent attack work?
The attack tricks an AI coding assistant into following legitimate-looking setup instructions that eventually retrieve and execute attacker-controlled commands from a DNS record.
Does the GitHub repository contain malware?
No. The researchers designed the attack so the repository itself appears clean, making the malicious payload much harder to detect during code reviews.
Which AI coding assistant did researchers test?
Mozilla’s 0DIN researchers demonstrated the technique using Claude Code, though they warn similar AI coding agents that automatically troubleshoot installation issues could face comparable risks.
0 responses to “GitHub Repository Trick Can Fool AI Coding Agents Into Running Hidden Malware”