Threat · curated 13 Jul 2026

Mozilla Shows the Danger of Indirect Prompt Injections in AI Coding Agents

First reported 13 Jul 0din.ai

Coverage timeline

Single-source research — first reported, latest, and curated coincide.

Why it matters

AI coding agents can be fully weaponized against developer systems through content that no scanner or reviewer would ever flag, making indirect prompt injection a serious code-execution and data-exfiltration vector for the software supply chain.

Mozilla 0DIN researchers Andre Hall and Miller Engelbrecht demonstrated a proof-of-concept attack where a clean GitHub repository with no malicious code uses indirect prompt injection to trick AI coding agents like Anthropic's Claude Code into chaining routine actions that grant an attacker shell command access and persistence. The malicious payload never appears in the repository; instead it is pulled at runtime from DNS after the agent blindly trusts the repo, evading scanners and human review.