Threat
Claude Code RCE: How a Malicious PR Triggers Code Execution
Publication date not yet evaluated · Added immersivelabs.com
Page published
Coverage timeline
Single-source research — one report is available.
Why it matters
Claude Code is a widely used AI coding agent, and an RCE triggered simply by reviewing a malicious pull request turns routine agent-assisted development into a supply-chain attack vector for developers and their CI environments.
Immersive Labs describes a Claude Code remote code execution vulnerability in which a malicious pull request can trigger code execution when the AI coding agent processes the repository. The attack leverages attacker-controlled content in a PR to coerce the agent into executing code on the host.