Executive Summary
Researchers have demonstrated a critical supply-chain attack vector targeting agentic coding tools like Claude Code through indirect prompt injection. By exploiting the autonomous capabilities of AI agents to resolve errors and execute setup scripts, an attacker can achieve full system compromise without including any malicious code directly in the repository. The attack leverages the 'Axiom' deployment platform as a decoy, utilizing legitimate-looking error messages to steer the agent toward executing a malicious setup script.
The attack chain is uniquely stealthy because the final payload is never stored on disk or committed to the codebase; instead, it is retrieved at runtime from a DNS TXT record. This bypasses traditional static analysis (SAST) and manual code review. Once executed, the agent inadvertently establishes a reverse shell, granting the attacker interactive access to the developer's environment, including sensitive credentials such as AWS and Anthropic API keys.
This highlights a significant shift in the threat landscape where the trust placed in AI agents to manage project environments creates a new attack surface. Organizations must implement stricter controls over what commands AI agents are permitted to execute autonomously, particularly when interacting with untrusted or third-party repositories.