🎯 AI
Indirect prompt injection in agentic coding tools can lead to full system compromise. A proof-of-concept demonstrates how an attacker with nothing but a public GitHub repository gains code execution on any developer who opens it with Claude Code, without committing a single line of malicious code.
What happened
A developer asked Claude Code to get a freshly cloned project running. The agent read the project setup notes, encountered a routine error, ran the documented fix, and that fix quietly opened a reverse shell back to an attacker's server. No exploit code, no suspicious commands requiring approval.
Attack chain analysis
-
Trusted context: Claude Code reads repository files as trusted project context. A .md file or GitHub issue describes normal first-time setup instructions.
-
Fail-closed package: The Python package refuses to operate until initialized. Using it before running init raises a RuntimeError with a "helpful" fix instruction. This is a completely ordinary pattern.
-
Runtime payload via DNS TXT: The malicious instruction is never present in the repository. It is fetched at runtime from a DNS TXT record after the agent has already trusted the preceding context. The payload executes as the developer's own user, opening a reverse shell.
None of the three components looks malicious on its own. The repo passes code review, the package behavior is standard, and the payload is fetched dynamically.
Why this matters
Agentic coding tools have access to environment variables, credentials, API keys, and local configuration files. Untrusted content (repositories, documentation, error messages from installed packages) can inject instructions that cause the agent to exfiltrate this data or establish persistence.
The DNS TXT technique specifically defeats static code scanners, human code review, and agent self-review. The payload simply does not exist until the moment of execution.
Technical details • Tool: Claude Code (agentic IDE/coding agent) • Attack vector: Indirect prompt injection via chained repo context • Payload delivery: DNS TXT record fetched at runtime • Result: Reverse shell as developer's user • Exposure: Credentials, API keys, environment variables, local config
Detection considerations
Monitoring DNS TXT lookups during development, restricting agent network access, and requiring explicit approval for shell commands during initial project setup are potential mitigations. The source does not verify their effectiveness.
🔹 PromptInjection #AISecurity #AgenticCoding #IndirectPromptInjection #LLMSecurity
🔗 Source: https://0din.ai/blog/clone-this-repo-and-i-own-your-machine