Mozilla Researchers Show AI Coding Agents Can Be Tricked Into Running Malware

Executive Briefing

• Researchers demonstrated how a clean GitHub repo can deliver a reverse shell with no malicious code visible to scanners or reviewers
• Exploits Claude Code's auto-recovery behavior, tricking it into running a setup command that fetches attacker-controlled DNS instructions
• Attack chains three innocuous components — a repo, a Python package error, and a DNS TXT record — to compromise developer systems
• Successful exploitation grants attackers shell access to API keys, environment variables, and local config files
• Warns threat actors could distribute malicious repos via fake job listings, tutorials, or direct messages