AI Code Agent Opens Hidden Cyber Shell

Researchers have revealed a novel exploit targeting AI coding assistants, demonstrating how Claude Code can be tricked into establishing a hidden reverse shell on a developer's machine. This sophisticated attack circumvents traditional security measures by embedding malicious instructions within DNS text records, which are typically not scrutinized by static scanners or firewalls.

The exploit initiates with a seemingly innocuous Markdown file detailing the setup of a monitoring tool. When the tool is run without proper initialization, it generates a common error message. This message prompts the user to execute a specific setup command, a process that AI agents like Claude Code interpret as routine error recovery.

Upon executing the command, the AI inadvertently triggers a hidden shell script. This script then queries a remote attacker-controlled DNS text record. The record contains a base64-encoded reverse shell command that executes silently, establishing a connection back to the attacker's server. The potential for persistence exists through methods like planting SSH keys or scheduling hidden cron jobs.

Standard security tools failed to detect this threat because no individual step appeared suspicious. Static code scanners only registered a routine DNS lookup, and network monitoring saw only normal domain name resolution. The AI agent itself perceived the command as a pre-authorized setup procedure, highlighting a critical blind spot in current agentic AI systems toward indirect prompt injection. The findings underscore the necessity for AI coding agents to meticulously inspect scripts before execution and for developers to approach unfamiliar repositories with caution.