Researchers Find 120 Unclaimed Domains in AI Documentation Could Let Hackers Plant Malware via Agents
A study of 6,214 corporate domains found 120 unclaimed references in AI documentation that could be hijacked to deliver malware through AI agents like Claude, Codex, and Hermes.
The unregistered references can result from human error, renamed or abandoned packages, copy/paste mistakes, or hallucinated documentation, the researchers said. To demonstrate the risk, they registered some of those unclaimed names and hosted packages that would "phone home" when installed. It took less than an hour for a Fortune 500 company to start pinging the researchers' server, and the number of pinging organizations soon grew to "a few dozen more".
The researchers said that if they could do it, so could cybercriminals. In theory, an attacker could register an unclaimed package and place malware in it. If an AI agent with permission to execute shell or package-manager commands encounters that documentation, the device could become infected. According to the researchers, Claude, OpenAI's Codex, and Nous Research's Hermes were all "guilty" of being susceptible to such attacks.
Two fixes were proposed. First, companies need to clean up their documentation and ensure it does not reference non-existent or malicious content. Second, AI agents need to stop treating documentation as executable instructions. Since the latter is unlikely to happen soon, the immediate answer lies in the former. Meanwhile, organizations that use AI for coding should consider the risks before granting AI agents permission to execute commands, the researchers advised.