Overview
Mozilla 0DIN (Zero Day Investigative Network) is Mozilla’s AI security research platform investigating novel attack vectors against agentic AI systems and LLM applications.
Recent Developments
- 2026-06-25: Published PoC “Clone This Repo and I Own Your Machine” — clean GitHub repo tricks claude Code into reverse shell via DNS TXT payload (2026-06-27-mozilla-0din-claude-code-github-malware, mozilla-0din-claude-code-github-malware)
- Attack chain: Setup instructions → intentional init error → agent auto-runs fix → setup.sh fetches base64 payload from DNS TXT → bash execution
- No malicious code in repository; payload swappable via DNS without repo changes
- Distribution vectors: job postings, tutorials, DMs
- Mitigation recommendation: Agents should disclose full execution chain including dynamically fetched content
Related
- mozilla
- supply-chain-security
- supply-chain-attacks
- agentjacking
- coding-agents
- ai-code-assistance
- ai-agent-security
- anthropic
- github