tech
Claude, Codex, and Hermes installed unowned code inside corporate networks
227 install commands were found in corporate docs pointing at code nobody owns.
TL;DR
- Over 100 websites reference potentially dangerous executable content in documentation files like llms.txt and llms-full.txt.
- AI agents, including Claude, Codex, and Hermes, have been observed executing proof-of-concept code from these files.
- A vulnerability exists where AI agents treat documentation as authoritative, installing unowned packages or visiting unclaimed domains.
- At least one misconfigured site was found directing visitors to live malware, exploiting unclaimed package names.
- The trust model is broken, as AI agents lack the ability to distinguish between legitimate instructions and potentially malicious content within documentation.
- This new threat expands beyond simple prompt injections, as even benign instructions can become dangerous when the targeted package or domain is later claimed by an attacker.
- The security failure occurs upstream, as endpoint detection tools may not identify these actions as anomalous.