Mozilla's 0DIN security researchers demonstrated a proof-of-concept attack showing how indirect prompt injection can fully compromise a developer's system through AI coding agents like Claude Code. The attack chains three seemingly routine steps: a malicious repository presents normal setup instructions, a failing Python package directs the developer to run an init command, and a shell script fetches a payload via DNS TXT record — never stored in the repository itself. This means no static scanner or human reviewer can detect it. The result is a reverse shell giving attackers full access to credentials, API keys, AWS keys, and GitHub tokens, plus persistence on the developer's machine. The researchers warn that agentic coding tools have access to all the sensitive data needed for catastrophic, irreversible damage, and urge developers to treat unfamiliar repo setup instructions as untrusted code regardless of agent recommendations.
