Claude Code Runs DNS-Fetched Commands to Evade Scans

The vulnerability is pure misplaced trust. Developers and their AI assistants follow setup scripts with obedient faith. This attack weaponizes that routine compliance.

There's no malware to find. One line in a `package.json` file is the only trigger. It points to a domain.

The payload arrives dynamically and executes before anyone can question it. The door is already open.

Fixing this demands a habit change. The researchers propose one guardrail: the AI must display any script it's about to run automatically. That forces a human glance.

That glance is the entire defense. It treats external commands with deserved suspicion. Without this pause, the security model collapses.

You end up trusting a DNS record controlled by a stranger. The tools we built to accelerate work can, it turns out, just as efficiently automate our own compromise.