Threat
Mozilla Shows the Danger of Indirect Prompt Injections in AI Coding Agents
Publication date not yet evaluated · Added devops.com
Page published
Coverage timeline
Single-source research — one report is available.
Why it matters
AI coding agents can be fully weaponized against developer systems through content that no scanner or reviewer would ever flag, making indirect prompt injection a serious code-execution and data-exfiltration vector for the software supply chain.
Mozilla 0DIN researchers Andre Hall and Miller Engelbrecht demonstrated a proof-of-concept attack where a clean GitHub repository with no malicious code uses indirect prompt injection to trick AI coding agents like Anthropic's Claude Code into chaining routine actions that grant an attacker shell command access and persistence. The malicious payload never appears in the repository; instead it is pulled at runtime from DNS after the agent blindly trusts the repo, evading scanners and human review.