AI coding agents including Anthropic’s Claude, OpenAI’s Codex, and Nous Research’s Hermes have been observed automatically installing unclaimed code packages inside corporate networks, according to security researchers who tested the behavior against live systems. The findings expose a growing supply-chain risk tied to an emerging web convention that AI systems treat as trustworthy documentation.
The problem centers on llms.txt and llms-full.txt files, a new standard that websites use to provide machine-readable summaries of their content and structure. These files work much like the robots.txt standard that guides search engines, except they are aimed at AI systems. When configured incorrectly, they can reference executable content that agents install without human review. Researchers found that documentation files on more than 100 websites pointed to potentially dangerous packages, and at least one misconfigured site was directing both people and AI agents to live malware.
How the Vulnerability Was Discovered
Researchers at a stealth startup in Israel scanned 6,214 live domains belonging to defense contractors, Fortune 500 firms, and Big Tech companies. Among the 8,265 llms.txt and llms-full.txt files they located, 120 files, each on a separate site, referenced one or more code packages or domain names that were never registered.
To test the impact, the researchers registered a handful of the unclaimed names and hosted packages designed to contact their server when executed. Within an hour, they received a phone-home response from a Fortune 500 company. Over time, several dozen more responses arrived, coming from additional Fortune 500 organizations as well as startups. Their tracking beacon recorded the chain of parent processes that triggered each installation, ultimately identifying Claude, Codex, and Hermes as the agents involved. Anthropic, OpenAI, and Nous Research had not responded to requests for comment at the time of publication.
“The trust model is broken,” researcher Alon Hertz said. “Agents treat vendor docs as ground truth and don’t question them—and neither do the humans supervising them. Agentic AI usage is exploding, and agents are spreading across every layer—SaaS, cloud, endpoint. As they multiply, so does the supply-chain surface, and today’s guards don’t cover it.”
Why Misconfigured Files Create Risk
The affected files list nonexistent packages from registries such as PyPI and npm, along with installation instructions. One file contained the prompt “Installation: pip install [redacted],” while another read “npm install [redacted].” Because those package names are unregistered, an attacker could claim one and use it to host ransomware or any other harmful payload.
The vulnerability triggers when a coding agent with permission to run shell commands treats the file as authoritative setup documentation. Some agents then download and execute the referenced package. In other cases, the files point to nonexistent domain names, which an attacker could register and stock with malicious instructions. One example referenced an external test framework for integration testing, creating the same opening for takeover.
The researchers registered several of the unclaimed names and confirmed that agents reached out to their server within an hour of the first test.
Source
Image: arstechnica.com
