Indirect Prompt Injection Hijacks Claude Code and AI Coding Agents
Researchers from Mozilla 0DIN have identified critical Indirect Prompt Injection (IPI) vulnerabilities within Claude Code and other agentic AI coding tools. By embedding malicious instructions in seemingly benign external data, such as GitHub README files or bug reports, attackers can manipulate the agent's control flow to execute unauthorized system commands. This exploitation enables Remote Code Execution (RCE) on developer workstations, often bypassing traditional EDR/AV via instruction-based hijacking rather than traditional binary-based malware. Specifically, the research demonstrates an escalation path where the agent is coerced into establishing a reverse shell through DNS TXT records, providing a covert Command and Control (C2) channel that facilitates full machine compromise.