Claude, Codex, and Hermes installed unowned code inside corporate networks

A quiet but significant security flaw has emerged in how artificial intelligence agents interact with the web. Researchers discovered that popular coding assistants like Claude, OpenAI's Codex, and Hermes are automatically installing unowned code when they visit certain corporate websites. This is not a hack in the traditional sense but rather a consequence of agents blindly trusting machine-readable instructions.

The vulnerability lies in llms.txt and llms-full.txt files. These are emerging standards that websites use to provide summaries of their content for AI consumption. Think of them as the AI equivalent of robots.txt files, which tell search engines how to index a site. However, instead of just guiding crawlers, these files can now point to executable code packages.

According to research from a stealth startup in Israel, the scope of this issue is surprisingly wide. The team scanned over six thousand live domains belonging to defense contractors, Fortune 500 companies, and major tech firms. They found that more than a hundred of these sites contained references to code packages or domains that were not registered to anyone. This creates a wild west scenario where anyone can claim these unowned domains and host malicious payloads.

To test the real-world impact, the researchers registered some of these unclaimed names and hosted simple beacon code. The results were immediate and alarming. Within an hour, they received a phone-home response from a Fortune 500 company. Over time, they tracked dozens more executions from various large enterprises and startups. This proves that AI agents are actively processing these files and executing the linked code.

The chain of processes revealed that coding agents were the primary culprits. When an agent encounters an llms.txt file pointing to a code package, it downloads and runs it without sufficient verification. This behavior turns standard web browsing into a potential attack vector. Agents are essentially acting as unwitting downloaders for unverified software.

This incident highlights a critical gap in AI safety protocols. Most agents are designed to be helpful and efficient, which often means they follow instructions literally. They do not yet have the same skepticism a human developer would apply to an unknown code source. The lack of response from major AI providers suggests this is a widespread architectural issue rather than a simple bug.

What this means for you If you use AI coding assistants in your workflow, you must assume your agent can be tricked into executing arbitrary code. Always review the code generated by AI agents before running it in production environments. Do not trust the source of the code just because the AI downloaded it automatically.

Try this workflow: Use an AI assistant to scan your project's dependencies and llms.txt files for any external links. Ask it to list all domains referenced in these files and verify if they are owned by your organization. This simple check can prevent accidental execution of untrusted code.