Claude, Codex, and Hermes installed unowned code inside corporate networks

8.1 relevance

Critical security finding about AI agents installing unowned code in corporate networks, directly relevant to AI/ML ops and supply chain security.

AI/ML arstechnica.com

Answer the board on AI readiness

Arrive with evidence, not opinion. See how your foundation benchmarks against your peers, get a clear read, and leave with a ranked place to start.

Why It Matters

For platform engineers and architects building agentic workflows, this reveals a critical blind spot: AI coding agents treat vendor documentation as authoritative and execute shell commands without validation, creating a new supply-chain surface that bypasses traditional security guards and can compromise SaaS, cloud, and endpoint layers.

Key Takeaways

Audit your llms.txt and llms-full.txt files for unregistered package references and restrict agent shell execution permissions to prevent automatic installation of unowned code.

Claude, Codex, and Hermes installed unowned code inside corporate networks

Summary

Researchers found 120 llms.txt and llms-full.txt files on 6,214 scanned domains pointing to unregistered code packages or domains. When they registered a few and hosted proof-of-concept packages, coding agents including Claude, OpenAI's Codex, and Nous Research's Hermes automatically executed them inside Fortune 500 and startup networks within an hour. One live exploit on clerk.com uses an `npx` command to fetch and execute a malicious binary without adding it to the dependency manifest, demonstrating a real supply-chain attack vector targeting AI agents.

Author

Dan Goodin — Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. A journalist with more than 25 years experience, he has been chronicling the...