We were promised AI coding agents would rescue us from tedium. Nobody mentioned they'd also cheerfully run a stranger's shell script because a README asked nicely. It turns out the most dangerous phrase in modern software isn't "it works on my machine" — it's "let me just fix that error for you."

A Clean Repo With Dirty Intentions

Researchers at Mozilla's Zero Day Investigative Network (0DIN) built a proof-of-concept supply-chain attack that targets not the developer, but the AI agent doing the developer's grunt work. The repository itself is spotless — no malware, no obfuscated payload, nothing a scanner or a human reviewer would ever flag.

The Exploit Is Vibes, Not Code

The trap springs during setup. A Python package is rigged to fail until it's "initialized," politely printing an error message. Claude Code, ever the helpful colleague, runs the suggested fix: python3 -m axiom init. That command quietly pulls a value from an attacker-controlled DNS TXT record and executes it, opening a reverse shell with the developer's full privileges.

Here's the genuinely unsettling part: there's no exploit code to catch. The attack weaponizes the agent's eagerness to be useful. As 0DIN put it, "Claude Code never decided to open a shell. It decided to fix an error." The malicious instruction lives in a DNS record, not the repo, so static analysis turns up a whole lot of nothing. Once that shell is live, the attacker inherits everything the developer has: API keys, environment variables, local config files, and a comfy foothold for persistence.

For now it's a proof-of-concept, not a confirmed in-the-wild campaign, which is the good news. The researchers warn these poisoned repos could be seeded through fake job postings, tutorials, or a friendly DM. The fix 0DIN proposes is refreshingly sane: agents should disclose the full execution chain of any setup command — including scripts and code fetched at runtime — before running a single line. Until then, maybe don't let your agent git clone on autopilot. Trust, but verify the thing doing the verifying.

Curious how solid your own stack would hold up? Get in touch and we'll take a look.

Source: BleepingComputer