Claude Code security exploit: How a DNS TXT record triggers a reverse shell from a harmless repo

Mozilla's 0din security research team has demonstrated a Claude Code security exploit that coerces the agentic coding tool into opening a hidden reverse shell on a developer's machine. The attack requires zero malicious code inside the cloned repository. Instead, the dangerous payload arrives at runtime through a DNS TXT record controlled by the attacker. For AI builders and developers using agentic tools, this technique reveals a critical blind spot: indirect prompt injection through external data sources that traditional security tools fail to catch.

What happened

The exploit begins with an ordinary Markdown file that instructs the developer to install a package called Axiom, a common monitoring tool. When the tool is run without initializing it, Claude Code encounters an error message and, trying to be helpful, automatically executes a suggested setup command. That command triggers a hidden shell script which queries a DNS TXT record controlled by the attacker. The record decodes into a base64-encoded reverse shell command, which executes silently and connects back to the attacker's remote server.

Once inside, the attacker can establish persistence by deploying an SSH key or scheduling a hidden cron job. The entire sequence looks like ordinary developer troubleshooting. Static code scanners only see a routine DNS lookup. Network monitoring registers normal domain name resolution. The agent itself views the command as a pre-authorized setup step.

Why AI builders should care

Agentic coding tools have authorized access to everything an attacker needs: private environment variables, credentials, API keys, and local configuration files. The same tools simultaneously consume untrusted content from the internet. This architectural contradiction means that a single repository link shared in a job posting or chat message could expose every developer who simply opens it.

The core vulnerability is indirect prompt injection. The attacker does not modify the code but manipulates what the tool is allowed to execute or fetch at runtime. This goes beyond Claude Code. Most agentic AI systems share similar blind spots toward indirect injection from external data sources.

Previous research from Check Point detailed three separate vulnerabilities in Claude Code that enable remote code execution and data theft. Additional work from Reverse Labs showed how malicious skills and agents can compromise Claude Code when downloaded from untrusted sources. The DNS TXT record attack is a new vector in a growing pattern.

Practical implications

For teams shipping AI-assisted development tools or relying on them in daily workflows, the immediate takeaway is that trust boundaries need rethinking. 0din stressed that coding agents need to inspect exactly what setup script will actually run before executing anything at all.

Until agentic tools can meaningfully evaluate what a command actually executes, developers should:

• Treat unfamiliar automation as a genuine risk, regardless of how ordinary its files appear.
• Inspect setup scripts manually before allowing agents to run them.
• Avoid running Claude Code or similar tools on untrusted repositories in sensitive environments.
• Consider runtime sandboxing or network-level controls that can flag unexpected DNS lookups during setup steps.

Caveats

The evidence base consists of security analyses and proof-of-concept demonstrations from Mozilla's 0din team. Practical exploitability depends on deployment context, user behavior, and whether the agent has been granted the necessary permissions. Details may change as new advisories are published. The same technique may not apply to all versions of Claude Code or other agentic tools without validation. This is an active research area, and similar indirect attacks will likely remain difficult to prevent until runtime safeguards improve.

For now, the most reliable defense available to individual developers is caution with unfamiliar repositories and a refusal to let agents blindly execute setup commands from unverified sources.