Claude, Codex, and Hermes Installed Unowned Code Inside Corporate Networks
- Reference: 0185230801
- News link: https://yro.slashdot.org/story/26/08/27/207212/claude-codex-and-hermes-installed-unowned-code-inside-corporate-networks
- Source link:
> Documentation files on more than 100 websites are [1]referencing potentially dangerous executable content that gets installed automatically when visited by many AI agents [including Claude, OpenAI's Codex, and Nous Research's Hermes]. A few dozen companies, some of them Fortune 500s, are among those that executed proof-of-concept code. At least one misconfigured site is directing visitors, human or AI, to live malware.
>
> The potentially dangerous content is in llms.txt and llms-full.txt files, an [2]emerging convention websites employ to provide machine-readable summaries of the site's content and its high-level structure. These files are the AI equivalent of the [3]robots.txt standard that instructs search engines how to index the site's content. Google Lighthouse, a tool for helping web developers, has more [4]here . Correctly configured llms.txt and llms-full.txt files for Cloudflare are [5]here and [6]here .
"The trust model is broken," Alon Hertz, one of the researchers, wrote in an interview. "Agents treat vendor docs as ground truth and don't question them -- and neither do the humans supervising them. Agentic AI usage is exploding, and agents are spreading across every layer -- SaaS, cloud, endpoint. As they multiply, so does the supply-chain surface, and today's guards don't cover it."
"An agent doesn't distinguish between a page and a command," the researchers [7]wrote Thursday. "Everything it reads is input, and every input is a potential instruction. Which means the entire corpus of published data that agents are now wired to consume has silently become an execution surface -- and almost none of it carries the integrity guarantees we apply to actual code."
[1] https://arstechnica.com/security/2026/08/claude-codex-and-hermes-installed-unowned-code-inside-corporate-networks/
[2] https://llmstxt.org/
[3] https://en.wikipedia.org/wiki/Robots.txt
[4] https://developer.chrome.com/docs/lighthouse/agentic-browsing/llms-txt#how_the_llmstxt_audit_works
[5] https://www.cloudflare.com/llms.txt
[6] https://www.cloudflare.com/llms-full.txt
[7] https://whatwouldai.do/
Gaslighting (Score:3)
Notice the narrative's attempt to divert blame toward the Web at large: “It's not our fault; your ‘misconfigured site’ is the problem.” In the real world, the LLM industry bears the onus for piping together arbitrary execution locally to arbitrary input over HTTP.
Any attempt to claim otherwise is a distraction. Disregard it.
Re: (Score:2)
This report came from a security company, not a LLM developer. And their conclusion is pretty much the opposite of what you just said: any model that downloads unverified content from the web and treats it as instructions should be viewed as fundamentally insecure. The problem is models that trust unverified content.
Possibly unsolvable (Score:2)
Every competent engineer knows you should keep commands and data separate from each other. Mixing them in a single stream is begging for problems.
But is that possible for an LLM? I suppose every input token could come with a binary flag to indicate whether it should be interpreted as a command or not. When training a model with reinforcement learning, only reward it for following commands that are marked as commands. Also include counterexamples that have commands in the data stream, and give a negative
Simon didn't say (Score:2)
LLMs are really bad at playing Simon Says.
And the solution is... (Score:1)
So you need something to monitor the security and look for vulnerabilities. What could do that for you? More agents of course!
What took anybody so long to see this? (Score:2)
How can such an obvious fact as the massive extension of attack surface via the use of LLMs and LLM based agents be subject to "new" research today... one would have had to be completely ignorant of everything to not see this the very first day LLM based agents became a thing.