NEW GITHUB ATTACK USES PROMPT INJECTION TO TRICK AI CODING AGENTS

A malicious GitHub repository can compromise a developer's machine without containing a single line of obviously malicious code. Security researchers at Mozilla's GenAI bug bounty platform 0DIN found the attack vector, and it is nasty.

The trick is indirect prompt injection. Instead of hiding malware in the repository's files, the attacker embeds instructions that manipulate an AI-powered coding agent (Claude Code was the test target) into executing a payload fetched only at runtime. The payload itself, a reverse shell that opens an interactive connection back to the attacker, never appears in the repository. It is invisible to code review, static analysis tools, and even the AI agent reading the repo.

you may like

POLYMARKET CONFIRMS HACK! $3MN IN CRYPTO STOLEN FROM USERS

1PASSWORD LETS CLAUDE USE YOUR PASSWORD WITHOUT EVER SHOWING THEM

UNO REVERSE CARD: ALIBABA BANS CLAUDE CODE

HOW THE ATTACK WORKS

A developer clones a repository that looks legitimate. A job posting, a tutorial section, or a Slack message linking to it is enough to start the chain. The repo contains a setup script that instructs the AI agent to run certain commands. The command itself is not in the script: it is retrieved from a DNS entry at runtime. The AI agent, following the instructions, hits a routine error during the setup and automatically runs the script. That script resolves the DNS entry, downloads and executes the payload, and opens a reverse shell to the attacker's server.

From there the attacker has an interactive shell with the developer's own privileges. API keys, login credentials, environment variables, local configuration files- everything the developer's account can access is up for grabs. The agent simply follows the steps, recovers from the expected error as instructed, and unknowingly hands over the keys.

THE ACCESS THAT MAKES IT DANGEROUS

The reason this attack matters beyond the clever trick is the access that AI coding agents have by design. "Agentic coding tools have access to everything they need for this [attack]: private data, including environment variables, credentials, API keys, and local configuration files" That includes credentials, API keys, and local configuration files. The agent is running in the user's security context, so a reverse shell at the same privilege level means the attacker has full access to that developer's work environment. And because the malicious command is never written into the repository, traditional scanning tools cannot flag it.

THE FIX!

0DIN recommends that AI coding agents be redesigned to surface what a command will actually execute at runtime, rather than evaluating only the literal command string they see in the repo. In practice, that means the agent should show the developer the full expanded command before running it, or at least warn that the command is being sourced from an external location. The agent could also refuse to execute commands that pull payloads from DNS or other runtime sources without explicit approval.

"Developers should treat setup instructions and scripts in unfamiliar repositories as untrusted code, regardless of what their AI tool recommends" The advice cuts two ways. Developers should treat setup instructions and scripts in unfamiliar repositories as untrusted code, regardless of what their AI tool recommends. But the tools themselves should not be putting developers in a position where they have to second-guess every command the agent runs. The design assumption that a command string in a repo is safe to execute is now falsified.

IF YOU'RE USING CLAUDE CODE, WATCH OUT

The attack targets Claude Code specifically, but the technique generalises to any AI coding agent that can execute shell commands based on instructions in a repository. The vulnerability is not in Claude's safety systems per se: it is in the trust model that allows an agent to run a command whose full effect is only determined at runtime. Every agentic coding tool that follows setup steps automatically is susceptible until it adds runtime inspection.

what to read next

MICROSOFT TURNS TO AWS FOR GITHUB CAPACITY AFTER AI SURGE

OPENAI ACQUIRES ONA, INCREASES AGENTIC CAPABILITIES

NEW SPEC LETS AI AGENTS DISCOVER TOOLS WITHOUT MANUAL SET UP

For developers, the immediate takeaway is that a single repo link in a job posting or a tutorial is now a credible attack vector. No malicious code in the repo means no red flags for GitHub's security scanning or for the developer's own review. The attack leaves no forensic trace in the repo