Security researchers at an Israeli startup have identified a widespread vulnerability affecting corporate networks, in which AI coding agents are being tricked into installing non-existent software packages and accessing unclaimed domain names through misconfigured configuration files.
The researchers scanned 6,214 domains belonging to defense contractors, Fortune 500 companies, and major technology firms, identifying 8,265 llms.txt and llms-full.txt files—machine-readable documents designed to help AI agents understand website structure and content. Among these files, 120 contained references to 227 installation commands pointing to software packages that do not actually exist in official registries like PyPI and npm, or to domain names that remain unregistered.
To demonstrate the risk, the researchers registered several of the unclaimed package names and domains, then hosted code that would transmit a signal back to their server when executed. Within an hour, they received responses from a Fortune 500 company, and eventually collected dozens more from additional Fortune 500 companies and startups. The responses revealed that multiple AI agents, specifically Anthropic’s Claude, OpenAI’s Codex, and Nous Research’s Hermes, were involved in executing these commands. At least one confirmed case involved live malware hosted on a legitimate company domain.
The vulnerability stems from a fundamental limitation of large language models: they cannot reliably distinguish between legitimate instructions from trusted sources and potentially harmful commands embedded in untrusted third-party content. AI agents processing these configuration files treat them as authoritative documentation and execute their contents without verification. The researchers noted that the broken trust model allows attackers to register unclaimed packages or domains and host malware that gets automatically installed within corporate environments.
The source of the misconfigured entries remains unclear. Some predate the AI era and appear to have been manually created by humans, while others may have been generated by AI systems that either hallucinated package names or failed to validate authenticity, mirroring the behavior of the agents now exploiting them. The researchers emphasized that as agentic AI deployment expands across enterprise infrastructure, the supply chain attack surface continues to grow without corresponding security controls in place.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI