Clean Repo, Compromised Dev Machine: Indirect Prompt Injection Risks AI Coding Agents
Mozilla's 0DIN team showed that a spotless GitHub repo can hijack AI coding assistants like Claude Code via indirect prompt injection, pulling a malicious payload from a DNS TXT record at runtime. The attack grants attackers shell access, exfiltrates secrets, and leaves no trace in the repo, exposing a systemic risk for DevSecOps pipelines.