How Claude Code was tricked into running malware without a single line of bad code

Researchers from the Mozilla Zero Day Investigative Network, or 0DIN, demonstrated an attack where Claude Code eagerly executes malware from an apparently pristine repository. The exploit does not rely on classic security bugs, zero-day vulnerabilities, or broken authentication, but exploits the agent's hardwired logic of immediately trying to fix any error it encounters.

To trigger the trap, a developer just needs to ask the AI agent to deploy a project from a clean-looking repository. Within this repository lies a harmless-looking Python package designed to intentionally fail during installation while suggesting a standard initialization command.

The AI agent interprets this failure as a routine setup hiccup and runs the suggested command, which silently triggers a background script. Instead of querying a suspicious URL that security scanners would easily block, this script reads a TXT record from the attacker's DNS server, decodes a base64 string, and executes it.

Because no actual malicious code resides in the repository, static analysis tools, SAST scanners, and software bill of materials checks find absolutely nothing. The attacker gains a reverse shell with the developer's local privileges, granting access to active API keys, environment variables, and local configuration files while the agent calmly reports that the environment is ready.

This prompt-less exploit is not exclusive to Anthropic's tool, as popular alternatives like Cursor, GitHub Copilot, and Gemini CLI share the same hyper-active helper syndrome. A similar vulnerability was recently discovered in Microsoft repositories, where AI agents executed hidden payloads just by opening a folder.

The industry rushed to replace cynical, lazy human developers with overly enthusiastic digital interns, only to find out that these virtual assistants will happily burn the house down if a broken package politely asks them to hold the match. Perhaps giving autonomous terminal access to a glorified autocomplete engine wasn't the masterstroke of genius corporate executives thought it was.

Source: BleepingComputer