AI Coding Agents Installed Malicious Code in Fortune 500 Networks
Researchers at an Israeli stealth startup found that Claude, OpenAI's Codex, and Nous Research's Hermes automatically executed unregistered packages listed in llms.txt files, triggering phone-home responses from dozens of corporate networks including Fortune 500 companies.
👁 117 reads
Researchers at an Israeli stealth startup triggered automatic code execution inside the networks of a few dozen companies, including multiple Fortune 500 firms, by registering package names listed in misconfigured llms.txt and llms-full.txt files that AI coding agents treated as authoritative setup documentation.
- Researchers scanned 6,214 domains and found 120 llms.txt or llms-full.txt files pointing to unregistered package names or domain names that attackers could claim
- Within one hour of registering a handful of those unclaimed names, the team received a beacon response from a Fortune 500 company, with a few dozen more following
- Claude, OpenAI's Codex, and Nous Research's Hermes were identified in the process chains; at least one misconfigured site was found serving live malware
The team scanned 6,214 live domains belonging to defense contractors, Fortune 500, and Big Tech companies, finding 8,265 such files in total. Of those, 120 - each on a separate site - referenced unregistered package names from registries including PyPI and npm, or pointed to unregistered domain names. After the researchers registered a handful of the unclaimed identifiers and hosted beacon packages, a Fortune 500 company executed the code within one hour. Process-chain logs showed that coding agents including Claude, OpenAI’s Codex, and Nous Research’s Hermes were responsible for the installs. At least one misconfigured site was found directing visitors to live malware rather than a researcher-controlled proof of concept.
“The trust model is broken. Agents treat vendor docs as ground truth and don’t question them - and neither do the humans supervising them.”
Anthropic, OpenAI, and Nous Research did not respond to requests for comment before publication.
Google · Your sourcesQuantslant higher in your Google - one clickAdd to preferred sources →
More on this from QUANTSLANT
ai tools·Anthropic Launches Model Hardware Standard for Lab Equipment