Claude Code Tricked: Clean Repo Opens Reverse…

Mozilla 0DIN demonstrates that Claude Code executes malware from clean GitHub repositories by exploiting its own proactivity: a fabricated error, a DNS TXT record, and a reverse shell.

On June 27, 2026, Mozilla 0DIN researchers demonstrated a proof-of-concept that turns Claude Code's proactivity into an attack vector. Anthropic's AI agent, designed to autonomously solve problems, is induced to execute a reverse shell without any malicious code existing in the GitHub repository. The entire payload resides externally, in a DNS TXT record controlled by the attacker.

Key Takeaways

The GitHub repository is deliberately free of malicious code: no security tool would flag it as suspicious.
The attack triggers when Claude Code, trying to "be helpful," automatically runs an init command suggested by a fabricated error.
The chain uses three levels of indirection: error → shell script → DNS TXT record → base64 payload that opens a reverse shell.
The reverse shell operates with the developer's privileges, exposing API keys, environment variables, and configuration files.

How the Indirection Chain Works

The researchers built a Python package called Axiom that, once installed, generates an apparently legitimate error. The message suggests running python3 -m axiom init to fix a configuration issue. Claude Code, interpreting the error as a normal obstacle to project setup, executes the command automatically without asking the user for confirmation.

This behavior is not a conventional bug but a direct consequence of the agent's design. According to 0DIN researchers, quoted by BleepingComputer, the AI "treats this as a normal setup issue and automatically runs the suggested command while attempting to recover from the error." The decision to execute does not stem from a model compromise, but from internal logic that rewards proactive problem-solving.

The init command triggers a shell script that performs a DNS lookup against the domain _axiom-config.m100.cloud. The returned TXT record contains a base64-encoded string that, once decoded and passed to the shell, opens a reverse shell to an attacker-controlled server. Tom's Hardware, a second primary source on the research, confirms that "the TXT record contains an encoded (base64) string that simply opens a reverse shell."

The distance between the AI's initial action and the final payload is the core of the automated social engineering. The malware is never present in the repository: it transits through a channel that no traditional scanner inspects.

Why Security Controls Fail

The intentional cleanliness of the repository makes the attack invisible to standard checks. There are no malicious dependencies in requirements.txt, no suspicious scripts in the source code, no obfuscated binaries. In the formulation reported by Tom's Hardware, "very few security scanning tools (if any) would flag the repository."

The three levels of indirection—artificial error, intermediate script, external DNS record—shatter payload traceability. The AI agent never directly evaluates the reverse shell code: it evaluates an error, runs a script, and completely ignores the DNS record. As the researchers summarized in a quote reported by BleepingComputer, "the reverse shell is three steps of indirection away from anything Claude Code actually evaluated: an error message it trusted, a script that fetched a value, and a DNS record it never saw."

This architecture challenges the supply chain security paradigm, which assumes risk resides in verifiable code. Here the verifiable code is harmless; the risk lies in the agent's emergent behavior when faced with seemingly benign inputs.

"Claude Code never decided to open a shell. It decided to fix an error." — Mozilla 0DIN researchers

The Real Exposure Perimeter

Once active, the reverse shell operates with the privileges of the user who launched Claude Code. In a typical developer context, this means access to API keys stored in environment variables, sensitive configuration files, authentication tokens for cloud services, and potentially SSH keys for private repositories. According to BleepingComputer, the shell "runs with the developer's privileges, giving access to API keys, environment variables, config files."

The attack is demonstrated as a proof-of-concept, not as in-the-wild exploitation. However, the researchers highlighted the ease of distribution through common social vectors: fake job postings requiring a repository clone, technically plausible tutorials, blog posts with "demonstrative" projects. The barrier to attack is low because it requires no GitHub account compromise, code injection, or sophisticated obfuscation techniques.

The dossier does not specify whether the same chain is reproducible on other AI agents such as Cursor, GitHub Copilot Chat, or similar tools. The attack is documented exclusively on Claude Code, and any extension of the mechanism to other products remains unverified.

What to Do Now

Verify that AI agents in use do not execute automatic commands without requiring explicit confirmation, especially for operations that require elevated privileges or access to external resources.
Inspect the DNS domain _axiom-config.m100.cloud and similar variants in network logs to identify any suspicious lookup attempts.
Evaluate implementing isolated sandboxes for sessions where AI agents interact with unverified repositories, limiting access to environment variables containing credentials.
Request full execution chain disclosure from AI agent vendors, including visibility into autonomously generated intermediate commands before execution.

Why This Matters

This research shifts the focus of AI cybersecurity from model vulnerabilities to behavioral vulnerabilities. It is not about prompt jailbreaks or training set poisoning, but about an interaction logic that rewards autonomy without sufficient distinction between safe and unsafe contexts. "Helpfulness" becomes an attack surface when the agent lacks a sufficiently rich world model to distinguish an artificial error from a genuine one.

For enterprises deploying AI agents in developer workflows, the message is clear: security controls must cover not only the code that executes, but the decisions the agent makes about what to execute. The perimeter expands from the repository to behavior, and this expansion is not yet reflected in prevailing trust and verification policies. Anthropic has not released an official patch or documented mitigation at the time of this dossier.

Sources

Information has been verified against cited sources and updated at time of publication.

Sources

Sources and references