Claude, Codex, and Hermes installed unowned code inside

What happened

Documentation files on more than 100 websites are referencing potentially dangerous executable content that gets installed automatically when visited by many AI agents. A few dozen companies, some of them Fortune 500s, are among those that executed proof-of-concept code. At least one misconfigured site is directing visitors, human or AI, to live malware.

” An attacker can then register the site and plant malicious instructions on it. As the researchers’ PoC demonstrates, coding agents did exactly that, including some running inside some of the world’s most powerful companies. Far from being a theoretical threat, at least one active attack is already exploiting the mixup. com.

” Unlike a conventional installation command, npx can fetch a package into npm’s cache and execute its exposed binary without adding it to the project’s dependency manifest. The researchers soon discovered that someone had claimed the once-empty slot and used it to host live malware. Clerk has since resolved the problem.

The company also noted that if an agent had already installed a binary included in the package @clerk/eslint-plugin, there was no threat. Otherwise, the malicious package would get installed. It’s unclear whether the confusion has resulted in actual infections. The newly uncovered threat is only the latest reminder of AI’s fundamental limitations.

LLMs can’t draw a reliable boundary between authentic user instructions entered directly into a prompt and content they find on untrusted third-party sources. Instructions the models encounter in retrieved content can be acted on as readily as anything a user typed, unless a properly constructed guardrail, put in place one by one, bars it. This so-far unsolvable shortcoming causes prompt injections.

Why it matters

txt files, an emerging convention websites employ to provide machine-readable summaries of the site’s content and its high-level structure. txt standard that instructs search engines how to index the site’s content. Google Lighthouse, a tool for helping web developers, has more here. txt files for Cloudflare are here and here.

Researchers at a stealth startup in Israel scanned 6,214 live domains belonging to defense contractors, Fortune 500, and Big Tech companies. txt file), 120 of them, each on a different site, pointed to one or more code packages or domain names that weren’t registered.

To test what happens when an AI agent processes such files, the researchers registered a handful of the unclaimed names and hosted packages that caused any machine executing them to reach out to their server. Within an hour, the researchers received a phone-home response from a Fortune 500 company. Over time, they got a few dozen more, some from more Fortune 500 companies and others from startups.

Their beacon also recorded the chain of parent processes that spawned each install, ultimately revealing that coding agents, including Claude, OpenAI’s Codex, and Nous Research’s Hermes, were involved. Anthropic, OpenAI, and Nous Research did not respond to requests for comment by the time of publication. “The trust model is broken,” Alon Hertz, one of the researchers, wrote in an interview.

“Agents treat vendor docs as ground truth and don’t question them—and neither do the humans supervising them. Agentic AI usage is exploding, and agents are spreading across every layer—SaaS, cloud, endpoint. ” The files are misconfigured because they list non-existent packages from PyPI, npm, and other registries along with instructions on how to install them.

” Because the package names are unregistered, an attacker could register one and use it to host ransomware or any other type of harmful package. The vulnerability occurs when a coding agent with permission to run shell commands treats the file as authoritative setup documentation. Some AI agents will then download the package and run it. In other cases, the LLM files point to non-existent domain names.

What to watch

“An agent doesn’t distinguish between a page and a command,” the researchers wrote Thursday. “Everything it reads is input, and every input is a potential instruction. ” The 120 misconfigured files the researchers found contained 227 commands to install non-existent packages or view unclaimed domains. It’s unclear how these faulty entries got there.

In many cases, the entries predate the AI era and were first included in non-LLM files on a website. That indicates that these faulty entries were manually generated by humans.