Researchers from Mozilla's Zero Day Investigative Network revealed a proof-of-concept (PoC) attack in which hackers gain full access of developer systems using AI agents like Claude Code. The exploit, published on June 25, 2026, is based on indirect prompt injection, where the prompt comes from an external source. It chains a normal looking Python Package with a malicious DNS (Domain Name Services) TXT record. This technique bypasses usual code scanners and human reviewers because the malicious payload is not in the code itself, but an external DNS record. This highlights a significant vulnerability in agentic AI coding tools, which accesses these credentials autonomously, without having a human review and verify the actions the AI is taking.