Security researchers at an Israeli stealth startup discovered that AI coding agents including Anthropic’s Claude, OpenAI’s Codex, and Nous Research’s Hermes automatically executed unclaimed code packages found inside web context files on corporate networks. After scanning 6,214 live domains across Fortune 500, defense, and Big Tech companies, the researchers identified 120 unregistered package names and domains referenced in llms.txt and llms-full.txt documentation files.
To demonstrate the supply-chain threat, the researchers registered several of the unclaimed package names with safe proof-of-concept code designed to ping their servers upon installation. Within an hour of deployment, the beacon recorded phone-home responses from a Fortune 500 network, eventually logging dozens of automatic installations triggered by autonomous coding agents parsing the web files as authoritative setup instructions.
The findings highlight a critical flaw in the trust model of agentic developer tools, which frequently execute shell commands and package installations without secondary verification. At least one active exploit is already leveraging these misconfigurations, raising urgent supply-chain security concerns for enterprise environments utilizing autonomous coding assistants.
Why it matters
Autonomous coding agents present novel supply-chain vulnerabilities when allowed to execute arbitrary package installations without human guardrails.
Enterprise security teams must update endpoint monitoring and proxy rules to inspect traffic generated by autonomous agentic developer tools.
The adoption of emerging AI context standards like llms.txt creates new attack vectors if documentation dependencies are not strictly verified.
Source: arstechnica.com
