Claude, Codex, and Hermes installed unowned code inside corporate networks, report says

The potentially dangerous content was found in llms.txt and llms-full.txt files, an emerging convention websites use to provide machine-readable summaries of their content and structure, similar to the robots.txt standard that guides search engines. Researchers at a stealth startup in Israel scanned 6,214 live domains belonging to defense contractors, Fortune 500 companies, and Big Tech firms. They located 8,265 such files; many sites hosted both llms.txt and llms-full.txt. Of those, 120 files, each on a different site, pointed to one or more code packages or domain names that were not registered.

To test what happens when an AI agent processes such files, the researchers registered a handful of the unclaimed names and hosted packages that caused any machine executing them to reach out to their server. Within an hour, they received a phone-home response from a Fortune 500 company. Over time, they received a few dozen more, from additional Fortune 500 companies and startups. The monitoring beacon also recorded the chain of parent processes that spawned each install, ultimately revealing the involvement of coding agents including Claude, OpenAI's Codex, and Nous Research's Hermes.

At least one misconfigured site is directing visitors, human or AI, to live malware, the report said. Anthropic, OpenAI, and Nous Research did not respond to requests for comment by the time of publication.

Alon Hertz, one of the researchers, wrote in written interview comments that the trust model is broken. “Agents treat vendor docs as ground truth and don't question them — and neither do the humans supervising them,” Hertz said. “Agentic AI usage is exploding, and agents are spreading across every layer — SaaS, cloud, endpoint. As they multiply, so does the supply-chain surface, and today's guards don't cover it.”

The researchers also wrote Thursday that an agent does not distinguish between a page and a command. “Everything it reads is input, and every input is a potential instruction. Which means the entire corpus of published data that agents are now wired to consume has silently become an execution surface — and almost none of it carries the integrity guarantees we apply to actual code.”