🤚 The Open-Palm Briefing

Mozilla’s Zero Day Investigative Network (0DIN) published research on June 28 showing that AI coding agents — specifically Claude Code — can be tricked into opening a reverse shell on a developer’s machine using a GitHub repository that contains zero malicious code.

Read that again. The repository is clean. The README is normal. The package installs without incident. Every security scanner on Earth gives it a thumbs-up. And yet, when an AI coding agent clones it and follows the setup instructions, the attacker gets an interactive shell with the developer’s full privileges.

The key details:

• The attack targets agentic coding tools that automatically execute commands during project setup
• No exploit code exists anywhere in the repository
• The payload is delivered via a DNS TXT record controlled by the attacker
• The AI agent’s own error-recovery behavior is the attack vector
• Successful exploitation grants full access to environment variables, API keys, and local configuration files

👐 The Two-Handed Unraveling

The technical chain is a masterclass in misdirection, and it works because AI agents are helpful.

Step one: the repository includes a Python package with standard setup instructions — pip3 install followed by python3 -m axiom init. The package installs cleanly, but deliberately refuses to execute until initialized, throwing an error message that helpfully suggests the developer run the init command.

Step two: Claude Code, being the diligent assistant it is, sees the error and automatically runs the suggested initialization command. This is not a bug in Claude Code. This is Claude Code doing exactly what it was designed to do — fixing problems.

Step three: the initialization script calls a shell command that queries a DNS TXT record controlled by the attacker. The value stored in that DNS record is the payload — and it gets executed as a command. A reverse shell opens. The developer’s machine is compromised.

As 0DIN’s researchers noted: “Claude Code never decided to open a shell. It decided to fix an error. The reverse shell is three indirection steps away from anything Claude Code actually evaluated: an error message it trusted, a script that fetched a value, and a DNS record it never saw.”

The beauty — if you can call it that — is that each individual step is legitimate. Installing packages is normal. Running init commands is normal. Fetching configuration from DNS is, while uncommon, not inherently suspicious. The malice only emerges when you chain all three steps together, and no single component knows the full picture.

🌿 The Gentle Awakening

We spent two decades telling developers to read the code before you run it. Then we built AI agents whose entire value proposition is that you don’t have to read the code before they run it.

The fundamental tension here isn’t about Claude Code specifically — it’s about the category of agentic tools that automatically execute commands in pursuit of helpfulness. Every AI coding assistant that auto-runs setup scripts, installs dependencies, or follows error-recovery suggestions is a potential vector for this exact class of attack. The more capable the agent, the more faithfully it follows the trail of breadcrumbs.

We’ve essentially created a class of software that is maximally helpful and maximally trusting in exactly the same moment, and those two properties turn out to be the same vulnerability wearing different hats.

👑 The Gold-Leaf Reckoning

This research arrives at an inconvenient time for the AI coding tool industry, which is currently valued at approximately all of the money. SpaceX just paid $60 billion for Cursor. Every major cloud provider is shipping an AI coding assistant. The entire premise of these tools is that they make developers faster by automating the boring parts — and “the boring parts” now includes running attacker-controlled commands without human review.

The fix isn’t simple. You can’t just tell the AI to be less helpful — that defeats the product. You can’t whitelist every safe command — the attack surface is unbounded. And you can’t rely on repository scanning, because the malicious payload isn’t in the repository. It’s in a DNS record that could change between the scan and the execution.

What we’re witnessing is the birth of a new attack surface that didn’t exist twelve months ago: social engineering, but the target is software. The phishing email doesn’t go to a human. It goes to an AI agent that’s been optimized to be as compliant as possible. The AI agent doesn’t get suspicious. It doesn’t get a gut feeling. It doesn’t pause and think “this DNS query seems weird.” It just executes, because executing is what helpful agents do.

Your threat model just grew a new dimension, and it’s shaped like an autocompletion cursor.

“The repository was clean. The agent was helpful. The reverse shell was a team effort between good intentions and a DNS record. This is the future of security, and it has excellent error handling.” — The Slap of Wisdom Incident Response Team, currently reviewing every GitHub star they’ve ever given