Researchers show how AI coding agents can be lured into running malware from clean GitHub repos
AI coding agents face a new supply chain risk
A new report from Mozilla’s Zero Day Investigative Network, or 0DIN, says agentic coding tools can be tricked into running malicious payloads from GitHub repositories that appear harmless to both scanners and human reviewers.
The concern is not a poisoned source tree in the usual sense. In 0DIN’s demonstration, the repository itself contained no obvious malicious code. Instead, the attack chain unfolded during setup, when Claude Code was asked to clone and run the project. That process, researchers say, could lead to an interactive shell on the developer’s machine without any overtly suspicious command being approved.
0DIN described the compromise as happening with “no exploit code, no warning, no suspicious command anyone had to approve.”
The method relies on three separate pieces that each look innocuous on their own. Together, they can mimic a common user mistake, trigger an error the agent trusts, and fetch a value that ultimately points to a malicious destination. The result is a reverse shell that is “three indirection steps away” from anything the AI actually evaluated, according to the researchers.
“Claude Code never decided to open a shell. It decided to fix an error. The reverse shell is three indirection steps away from anything Claude Code actually evaluated: an error message it trusted, a script that fetched a value, and a DNS record it never saw,” 0DIN researchers said.
If the attack succeeds, the intruder gets a shell running with the developer’s privileges, opening access to environment variables, API keys, local configuration files and the possibility of persistence.
0DIN says the technique is currently only a concept, but warned it could be distributed easily through fake job postings, tutorials, blog posts or direct messages.
To reduce the risk, the group recommends that AI agents disclose the full execution chain for setup commands, including scripts and any code fetched dynamically at runtime. That visibility, researchers argue, is essential if organizations want to stop supply chain attacks that slip past both automated defenses and human review.
Sources: