Claude, Codex, and Hermes installed unowned code inside corporate networks
ars ·
Researchers found 120 misconfigured llms.txt and llms-full.txt files across more than 100 websites that instructed AI agents to install code packages or visit domains that nobody owns. When the researchers registered a few of these unclaimed names, dozens of companies, including Fortune 500 firms, executed proof-of-concept code, with Claude, OpenAI's Codex, and Hermes identified in the process chains. The files contained 227 commands pointing to unregistered PyPI or npm packages and domains, which attackers could claim to distribute malware. The team also discovered that a legitimate file on Clerk.com directed agents to an npx command for a package that had been claimed with live malware, though Clerk has since resolved the issue. The researchers argue that AI agents treat documentation as authoritative and cannot reliably distinguish between user commands and instructions found in untrusted content, making the boundary between data and executable code dangerously thin. They note the weakness is broader than prompt injection because even benign, legitimate instructions can become dangerous when the packages or domains they reference are later abandoned and re-registered by attackers.
ars