AI Agents Execute Malware When Asked to Set Up a Clean GitHub Repo

*Mozillа’s 0din team showed that Claude Code and similar agents will run malicious code when handed an empty-looking repository and told to initialize it.*

Mozilla’s 0din researchers found that AI coding agents can be made to install malware simply by pointing them at a minimal GitHub repository that contains no obvious harmful files. The attack works because the agent follows its normal instruction to set up the project.

The method requires almost no setup on the attacker’s side. A repository is created with only the files needed to look legitimate to a human reviewer. When the AI is asked to initialize or configure the project, it executes commands that pull in and run the malware.

The same pattern applies to other agents beyond Claude Code. The researchers noted that the agents’ helpfulness, which is normally a feature, becomes the vector. No special prompt injection is required once the repository is presented as a standard task.

Why the attack succeeds

Current agents treat repository initialization as a routine coding step. They run package managers, build scripts, and dependency installers without additional checks for hidden payloads. The repository itself stays “clean” in the sense that it contains nothing a static scanner would flag before the agent acts.

The finding does not rely on novel zero-days in the models. It exploits the fact that agents are given broad permission to run shell commands on behalf of the user. Once that permission is granted, any repository the user points the agent at becomes an execution surface.

Practical consequences

Developers who rely on agents to bootstrap projects now have to treat every external repository as potentially hostile, even when it appears empty or minimal. Organizations that allow agents to run with elevated rights increase the chance that a single shared link can compromise a workstation or build environment.

The attack also raises questions about how much autonomy agents should have when interacting with external code. Granting them the ability to execute arbitrary setup commands without review trades convenience for a new class of supply-chain risk.

---

Sources:

• Tom's Hardware

{
  "excerpt": "Mozilla's 0din team showed that Claude Code and similar agents will execute malware when asked to initialize a minimal GitHub repository.",
  "suggestedSection": "security",
  "suggestedTags": ["ai-security", "claude", "malware"],
  "imagePrompt": "A lone laptop sits open on a wooden desk beside an unmarked folder and a single cable. The screen glows faintly in an otherwise dark room, with soft reflections on the desk surface. muted color palette, cinematic lighting, 16:9"
}