Reported by 1 outlet

Timeline

1. original reporting

   AI Coding Agents Weaponized — Clean GitHub Repo Delivers Reverse Shell via Claude Code Setup Instructions

   bleepingcomputer.com · 109d ago · June 27th, 2026

   Mozilla's 0DIN research team demonstrated a novel attack chain where a seemingly benign GitHub repository tricks AI coding agents (Claude Code used as proof-of-concept) into executing a reverse shell through three levels of indirection — with "no exploit code, no warning, no suspicious command anyone had to approve."

   The attack unfolds in three steps, each individually benign: (1) a clean repo's standard pip3 install -r requirements.txt installs a Python package designed to refuse execution until initialized; (2) the resulting error instructs the agent to run python3 -m axiom init, which Claude Code treats as a routine setup fix; (3) that command fetches a payload from an attacker-controlled DNS TXT record and executes it. The result is an interactive shell with the developer's privileges — full access to environment variables, API keys, local configuration files, and a foothold for persistence.

   The critical insight: Claude Code never decided to open a shell — it decided to fix an error. The reverse shell is three indirection steps away from anything the agent actually evaluated. While currently a proof-of-concept, 0DIN warns threat actors could distribute such repositories through fake job postings, tutorials, or direct messages. No vendor patch exists — the fix requires changes in how AI coding agents report and validate setup command chains. Every developer using AI coding assistants is currently an attack surface.