NewsPublished 29 Jun 2026

Researchers Demo New Claude Code Attack Using Harmless-Looking Repositories to Hijack Developer Machines

Source SecurityWeek

Description

Indirect prompts hidden in a repository can lead to Claude Code spawning a reverse shell on the developer’s machine. The post Researchers Demo New Claude Code Attack Using Harmless-Looking Repositories to Hijack Developer Machines appeared first on SecurityWeek .

Impact

Successful exploitation results in remote code execution on the developer's machine via a reverse shell, allowing attackers to exfiltrate credentials, API keys, tokens, and other sensitive information. Attackers can also establish persistent backdoors for ongoing access. The attack bypasses traditional detection methods because the malicious payload is fetched dynamically from DNS and never appears in the repository or network traffic in plaintext. This compromises the confidentiality and integrity of the developer's environment and potentially any connected systems or services.

Defensive guidance

Until an official fix or mitigation is available, developers should exercise caution when cloning and running setup scripts from untrusted repositories, especially when using AI coding assistants like Claude Code. Avoid automatically executing commands or scripts suggested by AI agents without manual review. Monitoring DNS queries for unusual TXT record lookups and restricting execution of scripts that fetch and run remote commands may help mitigate risk. Vendors and users should follow updates from Claude Code developers and Mozilla researchers for official patches or guidance.

Summary

The attack abuses Claude Code's trust in error messages and setup scripts within cloned repositories. When Claude Code encounters a Python package initialization error instructing to run 'python3 -m axiom init', it executes this command, which runs a shell script (setup.sh). This script retrieves a base64-encoded command from a DNS TXT record and executes it, spawning a reverse shell on the developer's machine. The payload is never stored in the repository or transmitted in plaintext, evading static and network detection. The attacker can remotely control the developer's system, exfiltrate secrets, and install backdoors. The attack is stealthy because each component alone appears benign: the repository contains no malicious code, DNS lookups are normal, and the AI agent follows legitimate setup steps. This multi-step indirection exploits the developer's trust in the AI assistant and the repository's setup process.

References

securityweek.com/new-attack-abuses-claude-code-and-harmless-looking-repositories-to-hijack-developer-machines/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 29 Jun 2026, 14:36 UTC

References

Community reviews