--- title: Mozilla Shows the Danger of Indirect Prompt Injections... description: Mozilla's 0DIN security researchers demonstrated a proof-of-concept attack showing how indirect prompt injection can fully compromise a developer's system... canonical: https://daily.dev/posts/mozilla-shows-the-danger-of-indirect-prompt-injections-in-ai-coding-agents-nqhoyxkhl twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Mozilla Shows the Danger of Indirect Prompt Injections in AI Coding Agents | daily.dev og:description: Mozilla's 0DIN security researchers demonstrated a proof-of-concept attack showing how indirect prompt injection can fully compromise a developer's system... og:url: https://daily.dev/posts/mozilla-shows-the-danger-of-indirect-prompt-injections-in-ai-coding-agents-nqhoyxkhl og:image: https://api.daily.dev/og/posts/nQhOYxKhL.png og:image:alt: Mozilla Shows the Danger of Indirect Prompt Injections in AI Coding Agents og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Mozilla Shows the Danger of Indirect Prompt Injections in AI Coding Agents **[DevOps.com](https://daily.dev/sources/devops)** · 4 min read · 0 upvotes · 0 comments ## Summary Mozilla's 0DIN security researchers demonstrated a proof-of-concept attack showing how indirect prompt injection can fully compromise a developer's system through AI coding agents like Claude Code. The attack chains three seemingly routine steps: a malicious repository presents normal setup instructions, a failing Python package directs the developer to run an init command, and a shell script fetches a payload via DNS TXT record — never stored in the repository itself. This means no static scanner or human reviewer can detect it. The result is a reverse shell giving attackers full access to credentials, API keys, AWS keys, and GitHub tokens, plus persistence on the developer's machine. The researchers warn that agentic coding tools have access to all the sensitive data needed for catastrophic, irreversible damage, and urge developers to treat unfamiliar repo setup instructions as untrusted code regardless of agent recommendations. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Claude Code Attack Uses Harmless-Looking Repositories to Hijack Developer Machines](https://daily.dev/posts/claude-code-attack-uses-harmless-looking-repositories-to-hijack-developer-machines-lrg1kpfix) · Security Boulevard · 0 upvotes · 0 comments - [Clean GitHub repo tricks AI coding agents into running malware](https://daily.dev/posts/clean-github-repo-tricks-ai-coding-agents-into-running-malware-x1de6wrky) · BleepingComputer · 11 upvotes · 2 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#ai-agents](https://daily.dev/tags/ai-agents), [#claude-code](https://daily.dev/tags/claude-code) [View this post on daily.dev](https://daily.dev/posts/mozilla-shows-the-danger-of-indirect-prompt-injections-in-ai-coding-agents-nqhoyxkhl) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Mozilla Shows the Danger of Indirect Prompt Injections in AI Coding Agents","url":"https://daily.dev/posts/mozilla-shows-the-danger-of-indirect-prompt-injections-in-ai-coding-agents-nqhoyxkhl","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/mozilla-shows-the-danger-of-indirect-prompt-injections-in-ai-coding-agents-nqhoyxkhl"},"datePublished":"2026-06-30T17:40:35.223Z","dateModified":"2026-06-30T17:58:50.614Z","description":"Mozilla's 0DIN security researchers demonstrated a proof-of-concept attack showing how indirect prompt injection can fully compromise a developer's system...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7944421cbb2a76aaabd8e15aa4157117?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7944421cbb2a76aaabd8e15aa4157117?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"DevOps.com","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"DevOps.com","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/db8f2265cff0416c878c6e7e92bb8715","url":"https://daily.dev/sources/devops"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/mozilla-shows-the-danger-of-indirect-prompt-injections-in-ai-coding-agents-nqhoyxkhl","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,ai-agents,claude-code","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"DevOps.com","item":"https://daily.dev/sources/devops"},{"@type":"ListItem","position":3,"name":"Mozilla Shows the Danger of Indirect Prompt Injections in AI Coding Agents"}]} ```