Claude Code Falls for a Clean Repo That Drops a Reverse Shell

"No exploit code, no warning, no suspicious command anyone had to approve." That's how Mozilla's Zero Day Investigative Network (0DIN) describes a new attack that weaponizes Claude Code's eagerness to fix errors.

The attack requires exactly zero malicious code in the cloned repository. Three indirection steps turn a clean pip3 install into an attacker-controlled interactive shell.

Three innocent steps that chain into a shell

Step one: the attacker publishes a GitHub repo with standard setup instructions - pip3 install -r requirements.txt then python3 -m axiom init. The Python package is designed to refuse execution until initialized, spitting out an error that tells the developer (or AI agent) to run that axiom init command.

Step two: Claude Code, tasked with setting up the project, sees the error and treats it as a normal setup issue. It automatically runs python3 -m axiom init to recover.

Step three: that command calls a shell script that fetches a configuration value from a DNS TXT record controlled by the attacker. The value is executed as a command. The attacker now has a reverse shell running with the developer's own privileges - access to environment variables, API keys, local config files, and a foothold for persistence.

What Claude Code never saw

0DIN researchers put it bluntly: "Claude Code never decided to open a shell. It decided to fix an error. The reverse shell is three indirection steps away from anything Claude Code actually evaluated: an error message it trusted, a script that fetched a value, and a DNS record it never saw."

The technique is a proof-of-concept today, but the distribution vectors are obvious: fake job postings, tutorials, blog posts, or direct messages pointing to a "helpful" GitHub repo. No malware in the repo means no static analysis or human code review flags it.

What AI agents need to stop this

0DIN suggests AI agents should disclose the full execution chain of setup commands, including any scripts or code fetched dynamically at runtime. That means auditing what pip3 install actually installs, what init scripts do, and what external resources those scripts call. Until agents inspect the execution tree dynamically, every pip3 install is a potential trust fall.

Source: Clean GitHub repo tricks AI coding agents into running malware
Domain: bleepingcomputer.com