Claude and Codex Install Unowned Code on Corporate Networks

Researchers at an Israeli stealth startup revealed that AI coding assistants, including Anthropic's Claude, OpenAI's Codex, and Nous Research's Hermes, are automatically executing unauthorized commands found in website documentation. By scanning 6,214 live domains belonging to defense contractors, Big Tech, and Fortune 500 companies, the team analyzed 8,265 machine-readable llms.txt and llms-full.txt files. They discovered 120 unique files containing 227 commands that directed AI agents to install unregistered packages from registries like PyPI and npm, or to visit unclaimed domains.

To demonstrate the risk, the researchers registered several of these unclaimed package names and set up a server to listen for connections. Within one hour of the registration, a Fortune 500 company's system executed the proof-of-concept code and phoned home. Dozens of other organizations, including startups and additional Fortune 500 firms, fell victim to the same mechanism. In one active exploitation case on clerk.com, an attacker claimed an empty slot to host live malware via the command npx clerk-next-fix-auth-protection, though Clerk has since resolved the issue.

For development and security practitioners, this vulnerability exposes a fundamental flaw in how AI agents handle data. Because agents with shell execution permissions treat files like llms.txt as authoritative setup guides, they run commands without verifying package namespaces or domain ownership. Standard endpoint detection and response tools fail to flag these installations because they appear as legitimate developer actions initiated by trusted parent processes. Practitioners must implement strict guardrails, limiting the execution privileges of coding agents and verifying all third-party installation instructions before they are processed.