Recent findings from Mozilla's 0DIN platform highlight a significant security vulnerability involving AI coding tools like Claude Code. Researchers have demonstrated that a compromised GitHub repository can execute hidden malware on a developer's machine without prior verification. This malicious code activates during runtime through a DNS query, remaining undetectable to both scanners and the AI agent itself. This situation raises critical concerns about the security protocols surrounding AI-assisted coding. It is essential for developers and organizations to reassess their reliance on automated tools and implement stricter verification processes. The implications of this discovery extend beyond individual developers, potentially affecting broader software supply chains and necessitating a collective response to enhance security measures.