AI Coding Tools Can Run Hidden Malware From GitHub Repos

Key takeaway

• Security researchers discovered a new attack vector where AI coding assistants like Claude Code can be tricked into running hidden malware from seemingly legitimate GitHub repositories.

• The attack exploits indirect prompt injection—malicious code is pulled from a DNS entry at runtime and executes automatically when the AI encounters a setup error, giving attackers reverse shell access to steal credentials and maintain persistence.

• The vulnerability underscores a significant risk for developers who use AI coding tools on untrusted third-party code.

3 Key Points

FAQ

How does the attack work without visible code in the repository?

A setup script in the repo pulls a command from a DNS entry at runtime and executes it. Because the malicious code is fetched dynamically rather than stored in the repository, it remains invisible to scanners, code reviews, and the AI agent until it runs.

What can an attacker do once they gain access?

Once the reverse shell is opened, the attacker can grab API keys and login credentials from the developer's machine and maintain persistent access.

What is the recommended fix?

AI agents should display what is in a setup script before running it, and developers should treat setup instructions in third-party repositories as untrusted code.