GoKawiilAI Coding Agents Auto-Installed Unregistered Code From Fake llms.txt Files
Israeli security researchers scanned over 6,000 corporate domains and found 120 llms.txt/llms-full.txt files—AI-readable site guides similar to robots.txt—referencing unregistered code packages or domains. When the researchers claimed those names and set up beacons, dozens of organizations, including Fortune 500 firms, triggered phone-home connections within hours, with process logs showing AI coding agents like Claude, Codex, and Hermes had automatically fetched and executed the unowned code. At least one misconfigured site was already pointing to live malware.
GoKawiil's interpretation of the reporting above, not reported fact.
AI agents are increasingly trusted to autonomously read and act on machine-readable web files, but this experiment shows that trust can be hijacked simply by squatting on referenced-but-unregistered code names. Because these agents operate inside corporate networks with real permissions, attackers could exploit the same gap to smuggle malware past traditional defenses that were built to catch human-driven, not agent-driven, threats.
- 120 llms.txt files across 6,214 scanned domains referenced unregistered code packages or domains.
- AI coding agents including Claude, Codex, and Hermes auto-installed the researchers' proof-of-concept code inside real corporate networks, including Fortune 500 firms.
- The incident exposes a new supply-chain attack surface where squatting on unclaimed names in AI-readable site files can trigger silent code execution.
Yubico YubiKey 5 NFC Security Key — When AI agents can quietly pull unowned code into corporate networks, hardware-backed authentication is one control that doesn't depend on a model's judgment. The YubiKey 5 NFC gives your accounts a physical second factor that plugs into USB-A or taps to a phone, making stolen credentials far less useful to an attacker.
See Yubico YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: arstechnica.com, 2026-08-27
Published there as: “Claude, Codex, and Hermes installed unowned code inside corporate networks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.