DNS-Exfiltrated Malware Exploits AI Coding Agents via Clean GitHub Repos

Forensic Summary

Mozilla 0DIN researchers demonstrated a novel attack chain in which a seemingly clean GitHub repository tricks AI coding agents like Claude Code into executing a reverse shell payload — with no malicious code ever present in the repo itself. The attack leverages three innocuous components: a Python package that deliberately errors on first run, an error message that instructs the agent to run an init command, and a shell script that fetches and executes a payload stored in an attacker-controlled DNS TXT record. The technique exploits the autonomous error-recovery behaviour of agentic AI tools, effectively turning a safety feature into an attack vector.

Read the full technical deep-dive on Grid the Grey: https://gridthegrey.com/posts/dns-exfiltrated-malware-exploits-ai-coding-agents-via-clean-github-repos/