Claude Code Attack Uses Harmless-Looking Repositories to Hijack Developer Machines
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Mozilla's 0Din researchers demonstrated an indirect prompt injection attack against Claude Code that uses seemingly harmless repositories to hijack developer machines. The attack hides malicious instructions inside a repository that trigger during setup: Claude Code reads a crafted error message and executes a recovery command, which fetches a Base64-encoded reverse-shell payload from a DNS TXT record and runs it. The technique splits components across the repo, DNS infrastructure, and the AI agent's trust model, making static analysis and network monitoring each see only benign activity. Affected developers risk credential, API key, and secret exfiltration. Recommended mitigations include requiring user approval before AI agents run shell commands, isolating untrusted repos in sandboxed environments, and monitoring for suspicious DNS TXT lookups and unexpected shell activity.
