A malicious GitHub repository can silently compromise a developer’s machine without containing a single line of malicious code, security researchers at Mozilla’s Zero Day Investigative Network (0DIN) warned. The attack The proof-of-concept attack targets AI-powered coding agents such as Claude Code, and uses indirect prompt injection to manipulate an AI agent into taking harmful actions the developer never explicitly authorized. The attack chain is as follows: The malicious repository presents normal-looking setup instructions in the … More
The post Mozilla warns of indirect prompt injection risk in AI coding agents appeared first on Help Net Security.
source & further reading
helpnetsecurity.com — original article
GPT-5.6 gets better at cybersecurity
DarkMoon: Open-source AI pentesting platform
Sycophantic chatbots and the harms that build over many chats