AI coding agents vulnerable to malware via GitHub repos, Mozilla researchers demonstrate Claude exploit

Mozilla's 0din security research team has demonstrated that AI coding agents like Claude can be tricked into executing malware through a deceptively simple social engineering attack. An attacker can create a GitHub repository that appears clean—with just scaffolding files and standard initialization files—that tricks Claude into installing malware. The attack exploits the agent's drive to be helpful: when the AI encounters an error during project setup, it tries to solve the problem automatically, triggering malicious scripts hidden in the repo.

The attack chain is subtle and three-layered. First, a fake Axiom startup script errors out, prompting Claude to run a help command. That command then downloads software from a malicious source disguised as a legitimate DNS TXT record lookup. The TXT record contains a base64-encoded reverse shell—giving the attacker shell access to the developer's machine. From there, attackers can exfiltrate secrets, API keys, code, documents, browser sessions, and passwords. The vulnerability doesn't require any obviously suspicious files; existing security scanning tools typically won't flag the repository or the activity.

For architects: this demonstrates that coding agents need fundamentally different security boundaries from human developers. Claude and similar agents lack the skepticism to question unclear third-party setup steps. The 0din team recommends that developers never blindly trust unknown projects and never rely on AI tools for security analysis. Agent vendors should implement execution sandboxing and require explicit user approval before running shell commands or downloading from the internet.