Claude, Codex, and Hermes installed unowned code inside corporate networks
Researchers found that 120 machine-readable website documentation files on 100-plus corporate sites referenced unregistered software packages or domains, creating an opportunity for attackers to claim those names and distribute malicious code. The issue matters because coding agents may treat these files as trusted setup instructions and automatically run installation commands inside company networks, expanding software supply-chain risks.
The researchers scanned 6,214 domains associated with defence contractors, Fortune 500 firms and major technology companies, finding 8,265 llms.txt or llms-full.txt files. After registering several unclaimed names with harmless ‘phone-home’ proof-of-concept code, they received responses from dozens of organisations, including Fortune 500 companies, and traced some installations to Claude, OpenAI Codex and Hermes; they also found one Clerk-related command pointing to an npm package hosting active malware.
- Unclaimed package names let attackers target AI-assisted corporate development environments.
- Researchers observed proof-of-concept executions at dozens of companies.
- One referenced npm package was found distributing live malware.
New here? Start with this
Coding agents such as Claude, OpenAI Codex and Hermes can read files that give software setup instructions, then run commands to install tools or packages. Some websites publish machine-readable guides called llms.txt files for these agents.
Software packages are named pieces of code that developers add to their projects. If a guide refers to a package or website name that nobody has registered, someone else may be able to claim it and use it to distribute code under that name.
This creates a supply-chain risk: instructions intended to help an agent can lead it to install code inside an organisation’s network. The issue links website documentation, automated coding tools and the wider practice of checking where software comes from.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The findings suggest that machine-readable documentation can become an overlooked route into corporate systems when coding agents treat its setup instructions as trustworthy. Organisations should audit these files and verify package ownership, since attackers who claim abandoned names could distribute malicious code through normal development workflows.
The case against
The reported cases show a potential weakness, but do not by themselves establish widespread compromise: the researchers used harmless proof-of-concept code for most claimed names, and the described installations are not evidence that those runs caused damage. Companies may reasonably see this as a manageable configuration and package-verification issue, best addressed with targeted checks and controls rather than treating all machine-readable documentation as inherently unsafe.