Mozilla’s 0din security research team has shown how an AI coding agent can be used to run malware from a GitHub repository that appears harmless during a routine project setup.
The demonstration involved Claude Code, Anthropic’s agentic coding tool, being asked to initialise a project from a repository. According to the report, the repository contained only a small number of scaffold files and did not include obvious malicious files.
The research was presented as a proof-of-concept. The available reporting does not indicate that the technique has been used in active attacks.
How the setup chain opened a shell
The attack relied on the agent following project setup instructions. After cloning or configuring the repository, Claude Code processed a Markdown file that directed it to initialise a Python environment using Axiom, a legitimate monitoring tool.
The repository also included a fake Axiom startup script. When the script failed, the agent attempted to resolve the issue by running another command: python3 -m axiom init.
That command triggered a shell script. The script read DNS TXT records from a domain used in the demonstration, _axiom-config.m100.cloud.
DNS TXT records are commonly used for configuration purposes, including email-related settings. In this case, the TXT record contained a base64-encoded string.
Once decoded and executed, the string opened a reverse shell. That gave the attacker remote command access to the developer’s machine while the setup process appeared to complete normally.
The victim and the AI agent would only see a message indicating that the environment was ready. The attacker would then have access to resources available to the user account.
Why the repository appeared clean
The method used three levels of indirection: a clean-looking repository, a package that failed during setup and prompted an initialisation command, and a DNS TXT record that supplied the payload at runtime.
The payload was not stored directly in the cloned repository. It was retrieved later through a DNS TXT record, placing the malicious command outside the files that would typically be reviewed before setup.
The same detail is relevant to static application security testing and software bill of materials checks that focus on files and dependencies present in the repository.
Because the payload was hosted outside the repository, the command executed at runtime was separate from the files committed to the repository.
A tightly controlled enterprise network could detect or block parts of the activity, particularly outbound network behaviour. The report noted that many developers do not work in environments with that level of network restriction.
Mozilla’s 0din team described the demonstration as one implementation of a broader risk involving project setup instructions, package scripts, and indirect payload delivery.
Secrets and developer access
The 0din report said this access could include secrets, API keys, code, documents, browser sessions, and passwords. An attacker could also install additional malware to retain access.
Once the reverse shell is active, the attacker would operate with the same privileges as the developer account or runner process that launched the agent.
The technique is relevant to environments where agentic coding tools are allowed to execute setup commands.
GitGuardian’s 2026 State of Secrets Sprawl report said 28.65 million new hardcoded secrets were added to public GitHub commits in 2025, a 34% increase from the previous year.
GitGuardian also reported an 81% rise in AI-service leaks. The 0din proof-of-concept described possible exposure of secrets, API keys, code, browser sessions, and other resources available to the developer account.
Agent permissions and safeguards
Stack Overflow’s 2025 Developer Survey found that 84% of respondents were using or planning to use AI tools in development, while JetBrains’ 2026 research found Claude Code had reached 57% awareness among developers.
OWASP’s Top 10 for LLM Applications includes excessive agency as a risk involving LLM systems that are given too much autonomy or access to powerful tools without proper limits.
Claude Code includes controls for managing tool permissions. Anthropic’s documentation says users can view and manage these rules through the /permissions command, which shows the permission rules applied to the tool and the settings files they come from.
Anthropic’s Claude Code documentation also describes a sandboxed Bash tool that provides filesystem and network isolation for autonomous agent execution. In the 0din proof-of-concept, the payload was retrieved through a DNS TXT record during setup.
What researchers recommend
The researchers advised developers not to treat unknown repositories as trusted code. They also warned against relying on an AI coding agent to assess whether a project setup process is safe.
0din said coding agents should show the full execution chain before running setup commands, including scripts and code fetched dynamically during runtime. The researchers also pointed to network restrictions during initialisation and human approval gates for automated setup steps.
The report said agents need to inspect what commands will run, what those commands call, and how external data is retrieved during setup.
(Photo by Markus Spiske)
See also: What is GLM-5.2? Z.ai targets coding agents
Want to dive deeper into the tools and frameworks shaping modern development? Check out the AI & Big Data Expo, taking place in Amsterdam, California, and London. Explore cutting-edge sessions on machine learning, data pipelines, and next-gen AI applications. The event is part of TechEx and co-located with other leading technology events. Click here for more information.
Developer Tech News is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.