Security researchers discovered a new attack vector that targets developers’ machines through a normal-looking GitHub repository. Attackers can gain full control via indirect prompt injection when an AI coding tool like Claude Code is used on the repo. The malicious code is invisible to scanners and code reviews, and can be triggered by a simple setup script. This vulnerability allows attackers to access sensitive information and maintain persistent access, making it a significant threat to developers. Why it matters: this story highlights the importance of verifying setup scripts and treating third-party repos with caution in the AI development landscape.