AI Coding Agent Malware: Clean GitHub Repo Exploits AI

A new report shows how a clean GitHub repository can trick an AI coding agent into running malware. A researcher cloned a repository, used an AI tool, and watched as the agent ran a recovery command. This command called an attacker-controlled script, leading to a reverse shell on the developer's machine. Here's the thing: the repository itself had no malicious code. The attack doesn't exploit bugs in GitHub or the AI model. Instead, it exploits the AI's ability to read and act on instructions. Every major AI coding tool is vulnerable to this type of attack. The demonstration showed a Python package designed to fail. The AI, trying to fix the error, suggested a command that invoked an attacker's script. This script then delivered a reverse shell with full system privileges. The AI simply tried to fix an error, not open a shell. Other attack techniques involve project configuration files with hidden instructions or even standard README files telling the AI to steal sensitive data. This matters because it highlights a significant security risk for any developer using these AI tools to explore unfamiliar code.