Security researchers have demonstrated a disturbingly simple way to compromise developers using AI coding assistants. A clean-looking GitHub repository with perfectly normal setup instructions can trick tools like Claude Code into executing a malicious payload — and nobody notices.
The attack, shown by Mozilla’s Zero Day Investigative Network (0DIN), requires no exploit code, no suspicious commands, and no warning signs. “No exploit code, no warning, no suspicious command anyone had to approve,” the researchers noted.
Here’s how it works. An attacker creates a standard Python project that throws an error when first run, telling the user to execute a setup command like python3 -m axiom init. Claude Code, trying to be helpful, automatically runs that command. The setup script then fetches a value from a DNS TXT record controlled by the attacker and executes it as a shell command.
Three separate components, each individually harmless. A repo with normal instructions. An error message that looks routine. A DNS record that’s invisible to the AI agent. Put them together and the attacker gets an interactive shell running with the developer’s privileges.
“Claude Code never decided to open a shell. It decided to fix an error,” the researchers explained. The attacker gains access to environment variables, API keys, local config files, and can establish persistence on the machine.
0DIN warns that threat actors could easily distribute such repositories through fake job postings, tutorials, blog posts, or direct messages on social platforms.
The fix? AI agents should disclose the full execution chain of setup commands, including any scripts and code fetched dynamically at runtime. Until then, maybe think twice before blindly running setup commands from that shiny new repo you found.
