Clean GitHub repo tricks AI coding agents into running malware
AI coding agents can be tricked into running malware via seemingly clean GitHub repositories.
Researchers have discovered a novel attack method where AI coding agents are tricked into executing malware hidden within seemingly legitimate GitHub repositories. The technique involves a clean repository with standard setup instructions that, when followed by an AI agent like Claude Code, trigger a chain of events leading to a reverse shell, bypassing security scanners and human review.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Mozilla?
Get an email when a new story names Mozilla, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers crafted clean-looking GitHub repositories with malicious setup instructions designed to exploit the autonomous execution behavior of AI coding agents like Claude Code. Because these agents follow natural language instructions without fully understanding malicious intent, a seemingly benign README or setup script can trigger a full reverse shell. This attack bypasses traditional static scanners and human code review since the repository itself appears legitimate — the danger lies in the instructions, not the code. It highlights a critical trust gap: AI agents are being granted significant system privileges without sufficient guardrails around the commands they execute. As AI-assisted development accelerates, this class of 'prompt injection via repository' attack represents a growing and underappreciated supply chain risk.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — reverse shell
- mitre_attack — T1059.004
- mitre_attack — T1573.002