I got a fully interactive shell on a developer's machine by asking Claude Code to do one ordinary thing: get a freshly cloned project running. No exploit code, no warning, no suspicious command anyone had to approve. Claude read the project's setup notes, hit a routine error, ran the documented fix, and that fix quietly opened a reverse shellReverse shellNormally you connect out to a server. A reverse shell flips that: the victim's machine connects back to the attacker and hands over a command line. It works because outbound connections often slip past firewalls that block incoming ones. back to my server.
The repository contained no malicious code. Every file in it is individually
boring and passes review. The payload that actually ran never lived in the repo
at all, it lived in a DNS TXT recordDNS TXT recordDNS is the internet's address book. A TXT record
can hold any short string, fetched live with one query like dig TXT name. Because that value
lives on the network, it never has to sit in the repository — which is the gap this attack
abuses. I control, fetched at runtime and piped straight
into a shell.
Reach & coverage
After 0DIN published the research, it was picked up across the security press, podcasts, and social platforms, 72 documented, URL-backed mentions and counting, and an entry in the OECD's AI Incidents Monitor.
Beyond the headlines, the finding circulated across Reddit, LinkedIn, X, YouTube, Mastodon, Threads, Facebook, and Instagram, and was covered in French, Japanese, and other languages alongside the English-language press.
Testing conducted against attacker-controlled infrastructure only.