AI Coding Agents Are Installing Unknown/Untrusted Code on Corporate Networks

We cannot forget that AI coding agents are not yet trustworthy:

Researchers at a stealth startup in Israel scanned 6,214 live domains belonging to defense contractors, Fortune 500, and Big Tech companies. Of the 8,265 llms.txt and llms-full.txt files they found (many sites hosted both an llms.txt and an llms-full.txt file), 120 of them, each on a different site, pointed to one or more code packages or domain names that weren’t registered. To test what happens when an AI agent processes such files, the researchers registered a handful of the unclaimed names and hosted packages that caused any machine executing them to reach out to their server. Within an hour, the researchers received a phone-home response from a Fortune 500 company. Over time, they got a few dozen more, some from more Fortune 500 companies and others from startups. Their beacon also recorded the chain of parent processes that spawned each install, ultimately revealing that coding agents, including Claude, OpenAI’s Codex, and Nous Research’s Hermes, were involved. Anthropic, OpenAI, and Nous Research did not respond to requests for comment by the time of publication.

This kind of thing will be exploited. Think Solar Winds–style supply chain attacks.

“The trust model is broken,” Alon Hertz, one of the researchers, wrote in an interview. “Agents treat vendor docs as ground truth and don’t question themand neither do the humans supervising them. Agentic AI usage is exploding, and agents are spreading across every layerSaaS, cloud, endpoint. As they multiply, so does the supply-chain surface, and today’s guards don’t cover it.”

Tags: AI, exploits, trust

Posted on September 4, 2026 at 6:35 AM • 2 Comments

Comments

Arno Nym • September 4, 2026 6:54 AM

“Not yet trustworthy” is an interesting way to put it 🙂

Kempton • September 4, 2026 8:05 AM

Thanks Bruce, this thing is insightful and a bit long so I jumped to the end and I love the bit, “The danger comes later …” which is a an understatement for the week.

//The research makes a compelling case that in the age of AI, the once-bright line between data and executable code is vanishing. [K’s note: This sounds like LISP or was it just me?] Anything an agent can process is a potential instruction it may act on if it has permission to run commands. [K: Yikes, this is nasty.]

“The Clerk case is the cleanest proof of it,” the researchers wrote. “The command looked exactly like something the vendor would ship—because it was in the vendor’s own instruction file. The only thing missing was the name in the registry. Every layer of trust was intact except the one nobody thought to check.” [K: always an “except”]

The source of this newly exposed problem is the same as the underlying cause of prompt injections. This newer weakness, however, is broader. [K: I love these six words a ton. I need to learn to write more of this kind of six words sentences.]

“In a prompt injection, someone deliberately plants malicious instructions,” Hertz explained. “Here, the instruction itself can be completely benign and come from a legitimate source—a real company’s own documentation—with no malicious actor involved at the time it was written. The danger comes later, when the package or domain it points to is abandoned and someone else claims it.”// [K: So adorable, “The danger comes later …”]

Schneier on Security

AI Coding Agents Are Installing Unknown/Untrusted Code on Corporate Networks

Comments

Leave a comment Cancel reply