Security researchers at 0DIN, Mozilla's GenAI bug bounty platform, discovered a new attack vector that exploits AI coding tools. Attackers can gain full control of a developer's machine by embedding malicious code in a GitHub repository. The malware is hidden and not directly visible in the repository, making it difficult to detect through standard scanning methods or code reviews.
The attack works by using a setup script in the repo that pulls a command from a DNS entry at runtime and executes it. The malicious code is not present in the repository itself, which allows it to evade detection by scanners and AI agents. When a user runs an AI coding tool like Claude Code on the repository, the tool hits a routine error message during setup, automatically runs the script, and opens a reverse shell to the attacker. This gives the attacker access to sensitive information such as API keys and login credentials, enabling persistent access to the target system.
The researchers emphasized that the attack can be triggered by a single repository link in a job posting, tutorial, or Slack message. They recommended that AI agents should display the contents of setup scripts before executing them, and developers should treat setup instructions from third-party repos as untrusted code.
Source: thedecoder
