Security researchers at Mozilla's Zero Day Investigative Network (0DIN) uncovered a new technique that allows AI coding assistants to execute malware by interacting with clean GitHub repositories. This attack exploits the way AI agents handle error recovery during project setup, enabling attackers to establish control without injecting malicious code into the repository itself.

The technique relies on a sequence of seemingly harmless components: a standard GitHub repo that includes typical setup commands, a Python package that refuses to run until properly initialized, and an initialization step that launches a shell script. This shell script fetches a command from a DNS TXT record controlled by an attacker and executes it. Because the AI agent treats the error as a common setup issue and automatically runs the suggested fix, it unknowingly triggers this chain of execution.

This innovative attack does not rely on any suspicious payloads within the repository. Instead, it abuses the AI agent’s automated error-handling process, which includes running commands recommended by error messages. As a result, the attacker can gain an interactive shell on the developer’s machine, inheriting their privileges and access to sensitive data such as environment variables, API tokens, and local configuration files. This access could also allow the attacker to establish persistence on the device.

0DIN researchers emphasize that the AI tool never explicitly chooses to open a shell; it simply attempts to fix an error. The actual malicious step occurs multiple layers downstream from any code the AI evaluates directly, making it difficult for human reviewers or automated scanners to detect. This shows how AI agents’ decision-making can be exploited through indirect commands fetched dynamically at runtime.

Though currently demonstrated as a proof of concept, experts warn that malicious actors could exploit this method by distributing deceptive GitHub repositories through job listings, educational content, or direct outreach. To counter such risks, the 0DIN team advises that AI coding assistants should provide full transparency on all setup commands executed, especially those involving dynamically loaded scripts and external resources. Proper testing of every execution layer before trusting code is essential to prevent covert compromises.