The rise of agentic coding tools is opening new attack vectors in the software development lifecycle. Researchers from Mozilla's 0DIN AI security platform have demonstrated a method to trick coding agents into executing malicious payloads using GitHub repositories that appear entirely clean, effectively bypassing security scanners and human oversight.

The Illusion of Benign Code

The attack does not rely on traditional exploit code or visible malware within the repository. Instead, it leverages the autonomous error-correction capabilities of AI agents, such as Claude Code. The attacker hosts a project with standard setup instructions (e.g., pip3 install -r requirements.txt). However, the Python package is engineered to fail upon execution, triggering an error message that prompts the user or agent to run a specific initialization command, such as python3 -m axiom init.

The Invisible Execution Chain

When the AI agent attempts to resolve the error by running the suggested command, it triggers a multi-step attack chain:
  • The initialization command calls a shell script.
  • This script fetches a configuration value from a DNS TXT record controlled by the attacker.
  • The retrieved value is then executed as a command on the developer's machine.
0DIN researchers highlight that the agent does not realize it is opening a reverse shell; it believes it is simply fixing a setup issue. This allows the attacker to gain an interactive shell with the developer's privileges, granting access to API keys, environment variables, and local configuration files.

A Growing Threat Landscape for AI Agents

This technique is part of a broader trend targeting AI-driven development. A similar pattern was observed with the Miasma worm, which compromised numerous Microsoft GitHub repositories by exploiting how developers interact with AI coding tools to steal cloud credentials.

To prevent such exploits, 0DIN recommends that AI agents disclose the full execution chain of setup commands, including any scripts or code fetched dynamically at runtime. Without strict transparency in command execution, agentic tools remain susceptible to sophisticated social engineering attacks embedded in code instructions.