Claude Code runs hidden malware in repos — and developers are defenseless
security researchers found that anthropic's claude code automatically executes hidden malware via dns query in github repos, compromising local machines. this exposes a critical vulnerability in autonomous coding agents where indirect prompt injections allow attackers to steal api keys and credentials.
researchers at mozilla's 0dIN platform discovered that anthropic's claude code agent automatically executes hidden malware when analyzing specific github repositories. the attack vector involves a setup script that fetches malicious commands from a remote dns entry at runtime, bypassing traditional scanners and the ai's own context window. once triggered, the agent opens a reverse shell, allowing attackers to steal api keys and maintain persistent access to the developer's machine. this vulnerability highlights the lack of sandboxing and verification in autonomous coding agents, suggesting that current ai tools cannot distinguish between legitimate build processes and security threats. experts recommend treating third-party repo instructions as untrusted and implementing strict user prompts before execution.