On May 15, 2025, security researchers at Mozilla’s 0DIN platform published a proof-of-concept demonstrating that a single compromised GitHub repository can hijack a developer’s machine the moment Claude Code runs its setup. The attack silently opens a reverse shell. No prompts appear.
TL;DR: Security researchers at Mozilla’s 0DIN demonstrated that a compromised GitHub repository can hijack a developer’s machine by tricking AI coding agents like Claude Code into executing hidden malware without verification, resulting in a silent reverse shell.
What Security Researchers at Mozilla’s 0DIN Discovered?
Researchers at Mozilla’s 0DIN security platform built a proof-of-concept showing that a completely clean-looking GitHub repository can trick AI-powered coding agents like Claude Code into silently opening a reverse shell on a developer’s machine. The repository contains no obviously suspicious executable files. Instead, the malware hides inside configuration files and markdown documentation that Claude Code processes automatically.
The attack targets the trust boundary that developers have established with AI coding assistants. When a developer clones a repository and asks Claude Code to analyze or work on the codebase, the tool reads all files in the project directory. This includes hidden configuration files that can contain executable instructions. The researchers showed that Claude Code follows these instructions without additional verification.
The proof-of-concept repository appeared completely legitimate to any human reviewer. It contained standard project files, a README, and typical configuration structures. Hidden within those files, however, were directives designed specifically for Claude Code’s file processing pipeline. The malware never triggers a warning prompt.
This discovery exposes a fundamental weakness in how AI coding agents handle untrusted input from cloned repositories. Traditional security tools scan for known malware signatures. They miss this entirely.
How Does the Hidden Malware Attack Work?
The attack chain begins when a developer clones a repository and instructs Claude Code to work on the project. Claude Code automatically reads files throughout the repository to understand the codebase structure and context. During this process, it processes configuration files that may contain embedded commands disguised as project settings.
The 0DIN researchers designed their proof-of-concept to exploit Claude Code’s automatic file processing behavior. The repository included a .claude/settings.json file containing a specific configuration that triggered command execution. Claude Code read this file during its standard initialization sequence and executed the embedded payload without prompting the user for confirmation.
The payload itself was a reverse shell command that connected the developer’s machine to an attacker-controlled server. Because Claude Code executes commands with the same permissions as the developer who launched it, the attacker gains full access to everything the developer can access. This includes source code, environment variables, API keys, and SSH credentials stored on the machine.
The attack requires no interaction beyond the initial clone and Claude Code invocation. Once the developer types a prompt asking Claude Code to work on the project, the compromise happens silently in the background. The developer sees normal Claude Code output while the reverse shell operates concurrently.
Traditional endpoint protection fails here because the malicious instructions live inside JSON and markdown files rather than executable binaries.
What Is the .claude/settings.json Exploitation Mechanism?
The .claude/settings.json file serves as a project-level configuration mechanism for Claude Code. Developers use it to define project-specific settings, allowed commands, and behavioral preferences. The 0DIN researchers discovered that this file can also contain directives that cause Claude Code to execute arbitrary commands during its startup sequence.
When Claude Code initializes in a project directory, it reads the .claude/settings.json file to load project configuration. The researchers found that certain configuration entries within this file trigger command execution without user confirmation. By crafting specific JSON entries, an attacker can instruct Claude Code to run shell commands, download additional payloads, or establish network connections during the initialization phase.
The exploitation works because Claude Code treats the settings file as a trusted configuration source. The file merges with user-level and system-level settings to determine Claude Code’s behavior in the project context. Since the file appears to be a standard project configuration artifact, developers rarely inspect its contents before allowing Claude Code to run.
Attackers can embed the malicious configuration alongside legitimate-looking settings entries. The JSON structure remains valid. No syntax errors appear. The file passes casual review because project configuration files routinely contain complex nested structures that developers skim rather than read carefully.
This mechanism requires no exploitation of software vulnerabilities in the traditional sense. It exploits the trust model itself.
Can Attackers Use Markdown Files to Trigger Arbitrary Commands?
Yes, attackers can embed executable instructions inside markdown files that Claude Code processes as part of its codebase analysis. The 0DIN researchers demonstrated that markdown documentation files can contain hidden directives that Claude Code interprets as actionable commands rather than passive documentation.
Claude Code reads markdown files like README.md and other documentation when analyzing a repository. The researchers found that hidden instructions within these markdown files can direct Claude Code to execute shell commands, modify files, or perform other actions on the developer’s machine. The instructions blend into the markdown formatting, making them difficult to spot during casual review.
The markdown-based attack vector works because Claude Code does not distinguish between documentation content and executable directives when processing repository files. A markdown file can contain sections that look like standard project documentation but actually contain step-by-step instructions directed at the AI agent. When Claude Code reads these files, it follows the embedded instructions as if they were user prompts.
This creates a multi-layered attack surface where both configuration files and documentation files serve as potential attack vectors. A repository can appear completely clean to security scanning tools while containing multiple hidden triggers waiting for an AI coding agent to process them. The combination of .claude/settings.json exploitation and markdown-based instruction injection gives attackers multiple paths to compromise.
The proof-of-concept showed that even experienced developers would struggle to identify these embedded instructions without specifically searching for them.
How Does This Attack Compare to Traditional Supply Chain Threats?
Traditional supply chain attacks typically rely on typosquatted package names or malicious dependencies hidden inside legitimate-looking npm or PyPI modules. Attackers would register packages with names nearly identical to popular libraries, tricking developers into installing them manually. The Claude Code attack vector works differently. It exploits the AI agent itself.
According to SecurityWeek’s analysis, the proof-of-concept demonstrates that a completely clean-looking repository can trick AI-powered coding agents into silently executing arbitrary commands without any explicit user approval. Traditional attacks required the developer to run a malicious install command. This new class of attack needs only for the AI agent to open the project.
The attack embeds malicious instructions within a settings.json file that Claude Code reads automatically during project initialization. The AI agent processes these instructions as legitimate configuration parameters. It then follows them without applying the same skepticism a human developer would use when evaluating unfamiliar code. This represents a fundamental shift in how supply chain compromises operate.
The trust boundary has moved. Instead of targeting the package manager, attackers target the AI intermediary that sits between the developer and the source code.
Which AI Coding Agents Are Vulnerable to This Technique?
Mozilla’s 0DIN researchers specifically demonstrated this attack against Claude Code, but the underlying vulnerability pattern extends to any AI coding agent that automatically reads project configuration files. CybersecurityNews confirmed that the proof-of-concept shows how agents can be tricked into opening a reverse shell on a developer’s machine through harmless-looking repositories.
Agents that auto-execute setup scripts or process repository-level configuration without sandboxing are all potentially susceptible. The core issue is not unique to one vendor. Any tool combining autonomous file reading with command execution capabilities faces similar risks when processing untrusted project files.
The vulnerability class affects agents that blur the line between reading configuration and executing commands. When an AI agent treats a settings file as an instruction list rather than passive configuration data, attackers gain an injection vector. Agents from different vendors may process configuration files differently, but the architectural pattern of autonomous trust creates risk across the ecosystem.
Developers should assume any autonomous coding agent has this attack surface until vendors explicitly document their configuration parsing boundaries.
What Are the Security Implications for CI/CD Environments?
Continuous integration and continuous deployment pipelines represent the highest-risk deployment scenario for this vulnerability class. CI/CD environments frequently run with elevated credentials, cloud access tokens, and deployment keys that grant production access. A single compromised repository analyzed by an AI agent could expose entire infrastructure stacks.
The attack becomes particularly dangerous in automated pipelines where AI agents run without human oversight. If a CI/CD system uses Claude Code or similar agents to automatically review pull requests or generate code from external repositories, the hidden malware executes with the full permissions of the pipeline runner.
Attackers could exfiltrate source code from private repositories, steal deployment credentials, or inject backdoors into production builds. The reverse shell demonstrated by 0DIN researchers gives attackers interactive access to the build environment, allowing lateral movement across connected systems.
Organizations running AI coding agents in CI/CD must implement strict sandboxing. Network isolation, read-only filesystem mounts, and credential vaulting become mandatory controls rather than optional hardening steps.
How Can Developers Protect Their Systems From Malicious Repositories?
Developers need to treat every external repository as untrusted code, even when an AI agent handles the initial analysis. The-decoder.com reports that the attack gives attackers full control the moment an AI coding tool runs the repository setup, meaning traditional code review happens too late in the workflow.
Protection requires defense-in-depth strategies applied before the AI agent touches any external code.
- Audit settings.json files manually before allowing any AI agent to open a repository
- Run AI coding tools inside containers with restricted network access and minimal filesystem permissions
- Disable automatic tool execution in Claude Code configuration when working with untrusted repositories
- Use read-only filesystem mounts so agents can analyze code without writing changes or executing binaries
- Implement network egress filtering to block reverse shell connections to attacker-controlled servers
- Review repository structure for unexpected configuration files or hidden dotfiles before cloning
- Separate development credentials from the environment where AI agents operate
- Apply principle of least privilege to all API tokens and cloud credentials accessible during AI-assisted development
| Protection Layer | Implementation | Threat Mitigated |
|---|---|---|
| Container isolation | Docker with --network=none | Reverse shell exfiltration |
| Manual config review | Inspect settings.json before opening | Prompt injection via settings |
| Credential vaulting | Use temporary scoped tokens | Lateral movement after compromise |
| Egress filtering | Block outbound connections on non-standard ports | Data exfiltration channels |
What Is the Root Cause of the AI Agent Trust Deficit?
The fundamental problem stems from how AI coding agents handle the boundary between data and instructions. Configuration files like settings.json contain both passive settings values and active behavioral directives. When Claude Code reads these files, it processes the content as instructions to follow rather than data to display.
This creates a prompt injection vector that exists at the architectural level. The AI agent cannot distinguish between legitimate configuration authored by the repository maintainer and malicious instructions planted by an attacker who compromised the repository.
Mozilla’s 0DIN researchers demonstrated that this trust model allows hidden commands within configuration files to execute with the full privileges of the AI agent. The agent follows instructions from the file because its design assumes configuration files are trusted input. This assumption breaks down when processing external repositories of unknown provenance.
The trust deficit will persist until AI agent vendors implement cryptographic signing for configuration files or separate the configuration parsing path from the instruction execution path entirely.
Frequently Asked Questions
Can disabling tool use in Claude Code prevent this attack?
Disabling autonomous tool execution significantly reduces the attack surface but does not eliminate it entirely. According to the-decoder.com, the attack exploits the settings.json file that Claude Code processes during project initialization, meaning the malicious instructions load before developers can review them. Restricting tool permissions limits what the injected commands can accomplish, but the initial configuration parsing still occurs.
Does this vulnerability affect other AI coding assistants like GitHub Copilot?
GitHub Copilot operates differently from Claude Code because it functions primarily as a code completion tool rather than an autonomous agent that reads project configuration files automatically. SecurityWeek notes that the proof-of-concept specifically targets agents like Claude Code that process repository-level settings during initialization. However, CybersecurityNews confirms that any AI-powered coding agent with autonomous file reading and command execution capabilities faces similar risks from this attack pattern.
What is a reverse shell and why is it dangerous in this context?
A reverse shell is a network connection where the compromised machine initiates an outbound connection to an attacker-controlled server, giving the attacker interactive command-line access. The 0DIN proof-of-concept demonstrated that Claude Code can be tricked into silently opening a reverse shell, which bypasses firewall rules because the connection originates from inside the trusted network. This gives attackers persistent remote access with the same privileges as the developer running the AI agent.
Has Anthropic released a patch for the settings.json vulnerability?
As of the research publication, neither the-decoder.com nor CybersecurityNews reported an official patch from Anthropic addressing the settings.json parsing behavior. The vulnerability stems from the architectural design of how Claude Code processes configuration files, meaning a fix requires changes to how the agent handles untrusted repository content. Mozilla’s 0DIN researchers disclosed the proof-of-concept publicly, putting pressure on vendors to address the underlying trust model.
Summary
- AI coding agents can execute hidden malware from clean-looking repositories through malicious settings.json files processed during project initialization
- The attack bypasses traditional supply chain defenses because the AI agent trusts configuration files as instructions rather than treating them as untrusted data
- CI/CD environments face the highest risk since AI agents running with elevated credentials can expose entire infrastructure stacks through a single compromised repository
- Developers must implement container isolation, manual configuration review, and credential vaulting before allowing AI agents to process external code
- The trust deficit requires architectural fixes from vendors, including cryptographic configuration signing and separation of data parsing from instruction execution
Review your AI coding agent configuration today. Audit every settings.json file in repositories you clone. Run your agents in isolated containers with restricted permissions until vendors address this vulnerability class at the architectural level.