[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fdwgHqSpEpKoiefyzdMdGJJabBTwGo0dTppJ0ZsbTfhw":3},{"article":4,"iocs":53,"watch_terms":64,"solutions":65,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"02df979d-6647-458a-bd5f-2bc00b41997a","Clean GitHub repo tricks AI coding agents into running malware","clean-github-repo-tricks-ai-coding-agents-into-running-malware-de5675","An agentic coding tool tasked with cloning and setting up a seemingly benign GitHub repository could execute a malicious payload that remains invisible to security scanners, AI agents, and human reviewers. [...]","Researchers have discovered a novel attack method where AI coding agents are tricked into executing malware hidden within seemingly legitimate GitHub repositories. The technique involves a clean repository with standard setup instructions that, when followed by an AI agent like Claude Code, trigger a chain of events leading to a reverse shell, bypassing security scanners and human review.","AI coding agents can be tricked into running malware via seemingly clean GitHub repositories.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fclean-github-repo-tricks-ai-coding-agents-into-running-malware\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2025\u002F10\u002F23\u002Fai-1.jpg","2026-06-27T14:22:36+00:00","2026-06-27T16:00:13.847455+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"Claude Code","product",{"name":21,"type":22},"Mozilla","vendor",{"name":24,"type":25},"AI coding agents","technology",{"name":27,"type":25},"GitHub",{"name":29,"type":25},"DNS TXT record","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":30,"icon":32,"name":33,"slug":34},null,"Supply Chain","supply-chain",[36,38,43,48],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,57,61],{"type":47,"value":55,"context":56},"reverse shell","Payload delivered via chained execution triggered by AI agent's error handling.",{"type":58,"value":59,"context":60},"mitre_attack","T1059.004","Execution of shell script retrieved from DNS TXT record.",{"type":58,"value":62,"context":63},"T1573.002","Data retrieval from DNS TXT record, potentially for exfiltration or command and control.",[21,18],{"controls":66,"vendors":150},[67,96,121],{"slug":68,"name":69,"problem":70,"products":71},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":42,"name":97,"problem":98,"products":99},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":117,"product_name":118,"url":119,"description":120},"boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",{"slug":122,"name":123,"problem":124,"products":125},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[126,134,142],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",[],{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":166},"ai-coding-agents-manipulated-into-running-malware-via-poisoned-github-repos","AI Coding Agents Manipulated Into Running Malware via Poisoned GitHub Repos","Attackers crafted clean-looking GitHub repositories with malicious setup instructions designed to exploit the autonomous execution behavior of AI coding agents like Claude Code. Because these agents follow natural language instructions without fully understanding malicious intent, a seemingly benign README or setup script can trigger a full reverse shell. This attack bypasses traditional static scanners and human code review since the repository itself appears legitimate — the danger lies in the instructions, not the code. It highlights a critical trust gap: AI agents are being granted significant system privileges without sufficient guardrails around the commands they execute. As AI-assisted development accelerates, this class of 'prompt injection via repository' attack represents a growing and underappreciated supply chain risk.",[156,157,158,159,160,161,162,163,164,165],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 10: Malware Defenses","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 AU-12: Audit Record Generation","NIST AI RMF: Govern 1.2 – AI Risk Policies","OWASP LLM Top 10: LLM01 – Prompt Injection","SLSA Supply Chain Levels for Software Artifacts – Source Integrity",{}]