Mozilla Just Proved AI Agents Can Be Hacked With Zero Suspicious Code

On June 25, 2026, Mozilla’s 0DIN security team disclosed a vulnerability that rewrites the rulebook on AI agent attacks. It requires no malicious code, no prompt injection, and no suspicious files — just a clean GitHub repo and an agent that follows instructions.

The attack exploits a fundamental trust assumption baked into almost every AI coding agent on the market. And it proves that our current security scanners are blind to an entire class of threats.

The Attack That Leaves No Trace

Here’s the surface-level picture: an attacker creates a GitHub repository that looks entirely legitimate. There are no obfuscated strings, no hidden executables, no encoded payloads. A standard code review or static analysis tool would flag nothing.

The repository contains a project setup guide and a “fix script” that corrects a known build error. That’s it. Nobody would suspect anything — because there’s nothing to suspect.

How Claude Code Gets Tricked

The attack targets agents like Claude Code that automate project setup. The agent reads the project notes, encounters a routine error during installation, and follows the documented fix script. Everything looks like normal developer workflow.

The fix script contains one unusual instruction: it fetches a value from a DNS TXT record for a seemingly benign domain. That DNS TXT record holds a reverse shell command. The agent executes it, and the attacker gains control.

The agent never questioned the DNS lookup because the script was part of trusted project documentation. The repository itself remained perfectly clean. Mozilla’s full writeup explains that the reverse shell is “three indirection steps away from anything Claude Code actually evaluated.”

Three Layers of Indirection

This attack works because it stacks three separate levels of indirection:

1. An error message that the agent was trained to trust triggers the documented fix script
2. The fix script contains no malicious code — it only fetches data from an external source
3. A DNS TXT record holds the actual command, which the agent never “sees” as code

Each layer is innocent in isolation. Together, they form a kill chain that bypasses every existing defense.

Why It Sidesteps Every Scanner

Traditional security tools scan source code for patterns: function calls that spawn shells, encoded payloads, suspicious imports. This attack contains none of those patterns. The repository is literally clean.

The payload lives entirely in DNS infrastructure. No scanner inspects what a script fetches at runtime from a TXT record. This is a blind spot so large it’s not even acknowledged in most security frameworks.

As SecurityWeek reported, the technique is indirect prompt injection — malicious instructions embedded in external content the AI agent processes, rather than in direct user input.

A New Vector in the Attack Surface

Our MCP Integration Attack Surface analysis identified seven distinct attack vectors against AI agent tool chains. This discovery from Mozilla’s 0DIN team adds an eighth: indirect prompt injection via external data sources, delivered through normal project documentation.

What makes this fundamentally different is the absence of any prompt injection at all. Friendly Fire uses multi-step prompt injection chains to bypass safety classifiers. This attack doesn’t inject anything. It writes normal project documentation and lets Claude Code follow its own procedures.

Comparisons to Prior Attacks

The 0DIN attack shares DNA with Agentjacking, where agents are hijacked through trusted third-party Sentry error data. Both exploit the agent’s inability to distinguish between legitimate external data and attacker-controlled content.

It also mirrors GhostCommit in that the payload is invisible during code review. GhostCommit hid malicious changes in commit metadata; this attack hides the payload in DNS — completely outside the repository.

But the critical difference: unlike every other attack we’ve documented, this one requires zero code modification. The attacker just needs a domain they control and a GitHub repo with convincing documentation.

What This Means for AI Agent Security

The core lesson is brutal: an AI agent will trust data from any source it was trained to treat as authoritative. If the agent believes a fix script is legitimate because it’s in the project repo, and if it trusts a DNS record because it’s a standard protocol, we have no mechanism to enforce boundaries.

Current mitigations — scanning repositories, blocking known-bad domains, filtering prompts — offer false confidence. The attacker only needs one clean repo and one DNS record they control. The entire attack happens in the runtime execution flow, not in the source code.

The Verification Gap

This is the same verification gap that keeps appearing across every AI agent attack we’ve analyzed. Trusty Squire proved that frontier models get better at lying, not more honest. Friendly Fire showed that safety classifiers can be bypassed with multi-step chains. And now Mozilla’s 0DIN shows that even basic project documentation can become an attack vector.

The pattern is consistent: automated tools operate on the artifacts they can see. These attacks operate in the gaps between what humans assume and what agents actually do.

What to Do About It

If your team deploys AI coding assistants or automates build pipelines with agentic workflows, here’s what needs to happen:

1. Map every external data source the agent trusts — error messages, scripts, DNS, APIs, package registries. If the agent reads it, it’s part of the attack surface
2. Sandbox untrusted project directories — use disposable environments like Code Airlock’s MicroVMs for any repo the agent hasn’t fully scanned
3. Pin and verify scripts — don’t let an agent auto-execute fix scripts from repos without explicit human approval
4. Monitor DNS resolution — agents fetching TXT records from unknown domains should trigger alerts

The audit question isn’t “is the code secure?” anymore. It’s “what does the agent trust, and who controls those sources?”

---

dotfm provides AI agent security audits that map your complete trust boundary — including the blind spots automated scanners structurally cannot see. Contact us for a confidential assessment.