TLDR Tech / InfoSec
Clean GitHub repo tricks AI coding agents into running malware
Mozilla 0DIN researchers demonstrated a proof-of-concept where an agentic coding tool like Claude Code clones a clean-looking GitHub repo with ordinary setup instructions (pip3 install -r requirements.txt, python3 -m axiom init), and a deliberately planted Python package refuses to run until initialized, emitting an error that prompts the agent to auto-run python3 -m axiom init as routine error recovery, which executes a shell script that pulls an attacker-controlled value from a DNS TXT record and runs it as a command. No malicious code lives in the repo, and no single step trips review, because the reverse shell sits three indirection layers from anything the agent evaluated (a trusted error message, a fetching script, and an unseen DNS record), yielding an interactive shell with the developer's privileges and access to environment variables, API keys, and local config for persistence. 0DIN, which notes threat actors could seed such repos via fake job posts, tutorials, or DMs, recommends AI agents disclose the full execution chain of setup commands, including dynamically fetched scripts and code. Defenders should run untrusted repos in sandboxed or containerized environments, deny agent outbound DNS/network egress during setup, and require human approval for any command that pipes fetched content into a shell.
Read the full story