Mozilla researchers revealed a new attack that tricks Claude Code into running hidden commands from seemingly harmless GitHub repositories.

All my agents needed was a little bit of codified workflows to follow ...