{"schema_version":"0.10.0","id":"LR-2026-0591","record_version":1,"title":"Clean GitHub repo tricks AI coding agents into running malware","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":43.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":2.88,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: BleepingComputer · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: BleepingComputer · subject to change"}]},"sources_hash":"d30d4a9e300f0094911e8365dfa9a4cd0cd7deab2da417cdff81e7226c31b3fd"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":"Runs with the developer's privileges, with access to environment variables, API keys and local configuration files","autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-06-27","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Researchers at Mozilla's 0DIN AI security platform demonstrated how Claude Code, an agentic coding tool, could be led to run a malicious payload when asked to clone and set up a clean GitHub repository. The package refused to run until initialised and printed an error telling the user to run an init command. Claude Code treated this as a normal setup issue and ran the suggested command, which fetched and executed a value from an attacker-controlled DNS TXT record. The demonstration showed that a shell running with the developer's privileges could result. The researchers stated that the attack method is currently just a concept, and no real incident is reported. 0DIN suggested that AI agents should disclose the full execution chain of setup commands.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK03"},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"negligible","severity_because":"Test: no effect beyond the system itself. The source states the attack method is currently just a concept, so no real effect is reported.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.bleepingcomputer.com/news/security/clean-github-repo-tricks-ai-coding-agents-into-running-malware/","publisher":"BleepingComputer","date":"2026-06-27","type":"press","title":"Clean GitHub repo tricks AI coding agents into running malware - BleepingComputer","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.permissions_scope":"C","event.incident_class":"C","event.agent_involved":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.permissions_scope":[{"source_index":0,"quote":"If successful, the attacker would obtain a shell running with the developer’s privileges, giving them access to environment variables, API keys, local configuration files, and the opportunity to establish persistence."}],"event.incident_class":[{"source_index":0,"quote":"They demonstrated how an attacker could plant an interactive shell on a developer's device by using Claude Code to run a cloned project without malicious code in the repository."}],"event.agent_involved":[{"source_index":0,"quote":"They demonstrated how an attacker could plant an interactive shell on a developer's device by using Claude Code to run a cloned project without malicious code in the repository."}],"impact.severity":[{"source_index":0,"quote":"While the attack method is currently just a concept, 0DIN warns that threat actors could easily distribute such GitHub repositories through fake job postings, tutorials, blog posts, or direct messages."}],"impact.severity_because":[{"source_index":0,"quote":"While the attack method is currently just a concept, 0DIN warns that threat actors could easily distribute such GitHub repositories through fake job postings, tutorials, blog posts, or direct messages."}],"event.summary":[{"source_index":0,"quote":"They demonstrated how an attacker could plant an interactive shell on a developer's device by using Claude Code to run a cloned project without malicious code in the repository."},{"source_index":0,"quote":"Executing python3 -m axiom init calls a shell script that retrieves the configuration value stored in a DNS TXT record controlled by the attacker, and is executed as a command"},{"source_index":0,"quote":"Claude Code treats this as a normal setup issue and automatically runs the suggested command while attempting to recover from the error"},{"source_index":0,"quote":"While the attack method is currently just a concept, 0DIN warns that threat actors could easily distribute such GitHub repositories through fake job postings, tutorials, blog posts, or direct messages."},{"source_index":0,"quote":"To prevent such exploitation, 0DIN suggests that AI agents should disclose the full execution chain of setup commands, including scripts and code fetched dynamically at runtime."}]},"notes_on_gaps":"The source describes a demonstrated attack concept, not a real incident; no real loss, victims, detection or response is reported. The publication date 2026-06-27 is the press article date, used as date_disclosed; the researcher disclosure date is not stated. The developer of Claude Code, the model name and version, the deployment context and the attacker identity are not stated and were left out. No failure_class or trigger was written because the source does not classify the failure or name a trigger in those terms. Severity negligible is my judgement from the source calling the method only a concept. Control C1 failed and B1 missing are my reading of the researchers' account. The C3 control in the advice is my choice, since the source does not name a control id, and the disclosure recommendation is only loosely mapped to it. Detection method, time to contain, and responsible party are not stated. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: BleepingComputer · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"done","text":"The researchers state that the attack method is currently just a concept.","quote":"While the attack method is currently just a concept, 0DIN warns that threat actors could easily distribute such GitHub repositories through fake job postings, tutorials, blog posts, or direct messages.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.bleepingcomputer.com/news/security/clean-github-repo-tricks-ai-coding-agents-into-running-malware/"]}}