We were promised AI coding agents would rescue us from tedium. Nobody mentioned they'd also cheerfully run a stranger's shell script because a README asked nicely. It turns out the most dangerous phrase in modern software isn't "it works on my machine" — it's "let me just fix that error for you."

A Clean Repo With Dirty Intentions

Researchers at Mozilla's Zero Day Investigative Network (0DIN) built a proof-of-concept supply-chain attack that targets not the developer, but the AI agent doing the developer's grunt work. The repository itself is spotless — no malware, no obfuscated payload, nothing a scanner or a human reviewer would ever flag.

The Exploit Is Vibes, Not Code

The trap springs during setup. A Python package is rigged to fail until it's "initialized," politely printing an error message. Claude Code, ever the helpful colleague, runs the suggested fix: python3 -m axiom init. That command quietly pulls a value from an attacker-controlled DNS TXT record and executes it, opening a reverse shell with the developer's full privileges.

Here's the genuinely unsettling part: there's no exploit code to catch. The attack weaponizes the agent's eagerness to be useful. As 0DIN put it, "Claude Code never decided to open a shell. It decided to fix an error." The malicious instruction lives in a DNS record, not the repo, so static analysis turns up a whole lot of nothing. Once that shell is live, the attacker inherits everything the developer has: API keys, environment variables, local config files, and a comfy foothold for persistence.

For now it's a proof-of-concept, not a confirmed in-the-wild campaign, which is the good news. The researchers warn these poisoned repos could be seeded through fake job postings, tutorials, or a friendly DM. The fix 0DIN proposes is refreshingly sane: agents should disclose the full execution chain of any setup command — including scripts and code fetched at runtime — before running a single line. Until then, maybe don't let your agent git clone on autopilot. Trust, but verify the thing doing the verifying.

Source: BleepingComputer