{"slug": "ai-coding-agents-followed-abandoned-package-references", "title": "AI coding agents followed abandoned package references", "summary": "Researchers found 120 unclaimed package or domain references across 8,265 llms.txt or llms-full.txt files on 6,214 live domains, including sites of defense contractors, Fortune 500 companies, and major tech firms, which AI coding agents could exploit to install malware. The researchers registered some unclaimed names and uploaded test packages, and within less than an hour a Fortune 500 company began contacting one, with a few dozen more following. Claude, OpenAI Codex, and Nous Research's Hermes all executed or followed the problematic references during testing.", "body_md": "[Security](/security/)\n\n• 3 min read\n\n# AI coding agents followed abandoned package references\n\nResearchers found 120 unclaimed package or domain references across corporate llms.txt files. AI agents could use them to install malware.\n\nImage: [TechRadar](https://www.techradar.com/pro/security/top-ai-tools-including-claude-codex-and-hermes-installed-suspicious-code-inside-corporate-networks)\n\nAI coding agents can turn stale documentation into a software supply-chain attack. Researchers examining documentation intended for AI readers found 120 references to unclaimed code packages or domains across websites operated by defense contractors, Fortune 500 companies, and major technology firms.\n\nThe problem centers on `llms.txt`\n\nand `llms-full.txt`\n\n, conventions that provide AI systems with a machine-readable version of a website’s content. An agent looking for installation instructions or code dependencies can search those files, then act on commands and package names found in them.\n\nThe researchers analyzed **6,214 live domains** and located **8,265** `llms.txt`\n\nor `llms-full.txt`\n\nfiles. The 120 problematic files were hosted on different sites and pointed to one or more package names or domain names that were not registered at the time of the study.\n\nThose references may have come from human mistakes, copy-and-paste errors, renamed packages, abandoned projects, or hallucinated documentation. The security risk is that an attacker can register one of the abandoned names and publish a malicious package at the location an AI agent has been told to use.\n\n## How the attack chain works\n\nFor the experiment, the researchers registered some of the unclaimed names and uploaded packages designed to phone home when installed. It took less than an hour for a Fortune 500 company to begin making contact with one of those packages. The number of organizations contacting the packages then grew to “a few dozen more.”\n\nRecommended reading\n\nEquifax automates half of its security tickets with AI\n\nSophia Reynolds • • 6 min read\n\n“a few dozen more”\n\nThat result demonstrates reachability, not a confirmed criminal campaign. The researchers' packages were deliberately created for the experiment, and the supplied findings do not establish that any company was infected or that production data was stolen.\n\nThe dangerous version of the chain is straightforward: an agent reads a stale or incorrect instruction, has permission to run shell commands or package-manager commands, and installs software from a name that an attacker has claimed. The agent does not need to identify the malicious package as suspicious if the documentation presents it as a legitimate dependency.\n\nThe researchers said **Claude, OpenAI Codex, and Nous Research’s Hermes** all executed or followed the problematic references during testing. That makes the issue broader than a defect in one vendor’s model. The common failure is unmaintained documentation combined with an agent allowed to treat documentation as an executable runbook.\n\n## Documentation cleanup is the immediate fix\n\nOrganizations publishing `llms.txt`\n\nfiles need to audit every package, command, and domain they reference. A dependency that was merely mistyped in documentation can become claimable infrastructure, while a package that was renamed or abandoned can remain an attractive target indefinitely.\n\nThe stronger control is to prevent agents from executing documentation instructions automatically. An agent could use the files as reference material while requiring an explicit approval step before running a shell command or installing a dependency. The source material does not establish whether the tested agents had such approval controls enabled, so it does not show how the results change under a restricted configuration.\n\nThe researchers' two recommended fixes address different parts of the chain: clean up broken references to remove attacker-claimable names, and restrict agent permissions so a bad reference cannot immediately become code execution. The first is an ordinary documentation-maintenance task; the second changes the trust model for AI-assisted development.\n\n## Frequently asked questions\n\n## What is the llms.txt security problem?+\n\nSome llms.txt and llms-full.txt files point to unregistered packages or domains. An attacker could claim those names and serve malware if an AI agent follows the documentation and installs the dependency.\n\n## Which AI coding agents were affected?+\n\nThe researchers said Claude, OpenAI Codex, and Nous Research’s Hermes were all affected during testing.\n\n## Did the researchers confirm malware infections?+\n\nThe supplied findings confirm that experimental packages received callbacks from a Fortune 500 company and a few dozen more organizations. They do not establish that production systems were infected or that data was stolen.\n\n[Sophia Reynolds](/authors/sophia-reynolds/)\n\nSecurity Editor\n\nSophia unpacks the invisible wars happening on our networks. Covering cybersecurity, privacy legislation, and cryptography, she exposes how our data is weaponized and defended. Before joining for(geeks), she spent years as a penetration tester. She's the reason the rest of the team uses physical security keys.", "url": "https://wpnews.pro/news/ai-coding-agents-followed-abandoned-package-references", "canonical_source": "https://forgeeks.net/ai-agents-abandoned-package-references/", "published_at": "2026-08-30 20:46:27+00:00", "updated_at": "2026-08-30 20:52:27.792509+00:00", "lang": "en", "topics": ["ai-safety", "ai-policy", "ai-agents", "ai-tools"], "entities": ["Claude", "OpenAI Codex", "Nous Research's Hermes", "Fortune 500"], "alternates": {"html": "https://wpnews.pro/news/ai-coding-agents-followed-abandoned-package-references", "markdown": "https://wpnews.pro/news/ai-coding-agents-followed-abandoned-package-references.md", "text": "https://wpnews.pro/news/ai-coding-agents-followed-abandoned-package-references.txt", "jsonld": "https://wpnews.pro/news/ai-coding-agents-followed-abandoned-package-references.jsonld"}}