AI Agents Installed Unowned Code in Corporate Networks

AI agents, including Anthropic's Claude, OpenAI's Codex, and Nous Research's Hermes, have been found to automatically install unowned executable code within corporate networks. This occurs when these agents process specially crafted documentation files, specifically `llms.txt` and `llms-full.txt`, which are emerging conventions for providing machine-readable site summaries and structural information to AI. Researchers from a stealth startup in Israel scanned 6,214 live domains belonging to defense contractors, Fortune 500 companies, and Big Tech firms. They identified 8,265 `llms.txt` and `llms-full.txt` files across these domains. Of these, 120 files on distinct websites contained references to code packages or domain names that were not registered. To investigate the implications, the researchers registered a selection of these unclaimed domain names and hosted packages designed to trigger a "phone-home" response from any machine executing them. Within an hour of this setup, the researchers received such a response from a Fortune 500 company, indicating that its AI agent had processed the malicious file. Over time, additional "phone-home" signals were received from several dozen more companies, including more Fortune 500 entities and startups. The researchers were able to trace the execution chain of parent processes, confirming that AI coding agents were responsible for initiating these installations. The `llms.txt` and `llms-full.txt` files serve a similar purpose to `robots.txt` for search engines, guiding how AI should interact with and understand a website's content. However, misconfigurations in these files, as observed in at least one instance, can direct visitors, whether human or AI, to live malware. The researchers' findings highlight a significant security vulnerability in how AI agents interact with web content, particularly in enterprise environments where these agents may be used for tasks such as code generation or information retrieval. The automatic execution of unverified code poses a substantial risk, potentially leading to data breaches, system compromise, or the deployment of further malicious software. The companies involved, Anthropic, OpenAI, and Nous Research, did not respond to requests for comment at the time of publication. This incident underscores the need for enhanced security protocols and validation mechanisms for AI agents interacting with external web resources, especially within sensitive corporate networks. The automatic installation of unowned code by AI agents represents a novel attack vector that security professionals must now consider in their threat assessments. The researchers' methodology involved a systematic scan and subsequent active testing of identified vulnerabilities, demonstrating a clear and present danger to organizations relying on AI for operational tasks. The implications extend to the broader ecosystem of AI development and deployment, emphasizing the critical importance of secure coding practices and robust security auditing for AI models and their associated data processing mechanisms.