Researchers at Mozilla’s Zero Day Investigative Network (0DIN) demonstrated how an attacker could plant an interactive shell on a developer’s device by using Claude Code to run a cloned project without malicious code in the repository.
The attack chain: (1) clean GitHub repo with standard setup instructions; (2) Python package designed to refuse execution until initialized, prompting Claude Code to run python3 -m axiom init; (3) init script retrieves configuration from attacker-controlled DNS TXT record and executes it as a command.
“Claude Code never decided to open a shell. It decided to fix an error. The reverse shell is three indirection steps away from anything Claude Code actually evaluated,” 0DIN researchers say.
0DIN suggests that AI agents should disclose the full execution chain of setup commands, including scripts and code fetched dynamically at runtime.