Clean GitHub repo tricks AI coding agents into running malware

Mozilla 0DIN researchers demonstrated a proof-of-concept attack in which an AI coding agent autonomously executes standard setup commands from a seemingly clean GitHub repository; an initialization command runs a script that retrieves a DNS TXT record controlled by an attacker and executes it, yielding a reverse/interactive shell with the developer's privileges. The chain contains only benign repository contents and automated agent actions, making it stealthy and recommending that agents disclose full execution chains and any dynamically fetched scripts.