Indirect prompt injection attack on Claude Code via poisoned Git repositories
Mozilla's 0Din security researchers demonstrated a proof-of-concept attack on Claude Code that uses indirect prompt injection through poisoned Git repositories to trick the AI into executing reverse shells and giving attackers remote access to developer machines. The attack requires no traditional malware or suspicious code and exploits the AI assistant's ability to interpret hidden instructions embedded in repository files.
What happened
Mozilla's 0Din security researchers demonstrated an attack that exploits Claude Code by embedding indirect prompts into Git repositories. When developers open a repository containing hidden malicious instructions in code comments, documentation, or configuration files, Claude Code reads and interprets them as legitimate commands.
The attack leverages Claude Code's ability to execute shell commands during its workflow. Attackers embed instructions that cause the AI to spawn a reverse shell, giving remote attackers interactive access to the developer's machine without any traditional malware, suspicious executables, or social engineering beyond opening a project file.
Reported impact
The attack enables remote attackers to gain full control of developer machines through reverse shell access. Researchers noted this represents a supply chain risk for developers using autonomous coding agents.
Index analysis
The attack works because Claude Code automatically processes repository contents as context without distinguishing between legitimate project files and embedded malicious instructions. The technique uses three individually benign components working together: standard installation commands that appear legitimate, a Python package designed to fail until initialized, and hidden prompts that trigger execution.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.