Researcher Alon Hertz Tricked Claude, Codex and Hermes Into Running Malware

Researcher Alon Hertz demonstrated that AI coding agents, including Anthropic's Claude, OpenAI's Codex, and Nous Research's Hermes, can be tricked into running malware by exploiting llms.txt files, according to Ars Technica. Scanning 6,214 domains and 8,265 files, Hertz found 120 files referencing unregistered packages and 227 install commands pointing to unclaimed code; within an hour of registering some names, a Fortune 500 company triggered a callback. Hertz stated, "The trust model is broken.

AI coding agents are reading corporate documentation as if it were trusted code. Alon Hertz's research shows why that habit can put unclaimed packages inside real company networks. Alon Hertz didn't need a zero-day to get code executed inside corporate environments. According to Ars Technica, researchers at a stealth startup in Israel found that ordinary llms.txt and llms-full.txt files, the plain text files companies publish to help AI systems read their sites, can point coding agents toward packages nobody owns. The numbers are uncomfortable. The researchers scanned 6,214 live domains tied to defense contractors, Fortune 500 companies and Big Tech firms. Across 8,265 llms.txt and llms-full.txt files, they found 120 files, each on a different site, that referenced unregistered package names or domains. Ars Technica reported that 227 install commands in corporate documentation pointed at code nobody owned. That is not a small typo class. It's a supply-chain opening. Then they tested it. The researchers registered a handful of the unclaimed names and hosted packages that would phone home when executed. Within an hour, a Fortune 500 company had triggered one of the callbacks. More followed from other large companies and startups. The process logs pointed to AI coding agents, including Anthropic's Claude, OpenAI's Codex and Nous Research's Hermes. Anthropic, OpenAI and Nous did not respond to Ars Technica before publication. Trump Weighs Chip Tariffs Up To 100% That Could Slow The AI Buildout https://startupfortune.com/trump-weighs-chip-tariffs-up-to-100-that-could-slow-the-ai-buildout/ The Trump administration is weighing semiconductor tariffs as high as 100% that would hit AI data center servers, laptops and gaming consoles, with exemptions only for chips made on U.S. soil. Tech industry lobbyists, including a former Trump official, are calling the plan a direct threat to the AI buildout it's supposed to support, according to... - trump administration semiconductor tariffs AI impact https://startupfortune.com/trump-weighs-chip-tariffs-up-to-100-that-could-slow-the-ai-buildout/ - how chip tariffs affect artificial intelligence development https://startupfortune.com/trump-weighs-chip-tariffs-up-to-100-that-could-slow-the-ai-buildout/ This is where the story stops being a curiosity about a young web convention and starts being something you should care about. llms.txt is often described as a robots.txt for AI, a file that tells agents which parts of a site matter. A March 2026 ProGEO.ai study found that only 37 of the Fortune 500, or 7.4%, had published one, compared with 92.8% that had a working robots.txt. Adoption is still thin, but the risk arrived early because agents can move from reading to running commands in the same workflow. Nobody checked the names. The weak link is trust To a security tool, this can look clean. A coding agent reads a file on an official company domain, sees a setup line, and runs pip or npm against a public registry. The domain is trusted. The package manager is trusted. The agent is trusted. Frankly, that chain is exactly why the attack works. Hertz put it plainly in the Ars Technica report: "The trust model is broken." The issue is not that llms.txt is malicious by design. The issue is that agents can treat published text as instructions and then act on it with the same confidence they would bring to a command pasted by a developer. That is enough. The researchers also found at least one live malware case tied to the same failure mode. An llms file on clerk.com, the website of the authentication company Clerk, contained the command npx clerk-next-fix-auth-protection. The catch sits inside npm behavior. npx can fetch a package into cache and execute its exposed binary without adding it to a project's dependency file. If the expected local binary was already present through @clerk/eslint-plugin, Clerk said there was no threat. If it was not, npx could look up the bare name on the public registry. Someone had claimed that bare package name and used it to host malware. Clerk has since resolved the problem, according to Ars Technica. The company did not have to lie to users for the weakness to exist. The command sat in legitimate documentation, and the dangerous part appeared later when the public registry filled the empty slot. Germany Admits It Doesn't Have Enough AI Compute to Keep Up https://startupfortune.com/germany-admits-it-doesnt-have-enough-ai-compute-to-keep-up/ Germany's digital minister Karsten Wildberger says the country's AI computing capacity, roughly 530 megawatts at the end of 2025, is badly behind the US and China, and much of it runs on foreign-owned infrastructure. Berlin has approved a plan to double data center capacity and quadruple AI-specific compute by 2030, but the gap with American... - germany lacking ai computing infrastructure capacity https://startupfortune.com/germany-admits-it-doesnt-have-enough-ai-compute-to-keep-up/ - why europe falling behind us china ai https://startupfortune.com/germany-admits-it-doesnt-have-enough-ai-compute-to-keep-up/ Clerk is the warning, not the villain It would be too easy to make this a Clerk story. Don't. The Clerk example is useful because it shows how the failure can happen inside normal developer plumbing, with scoped npm packages, command aliases and agent behavior all meeting in one place. That is the real problem: software teams are wiring agents into systems that were built for humans who pause, notice context and ask whether a package name looks odd. Agents don't pause enough. A README, an API changelog, a vendor doc page and an llms.txt file can all become inputs. If the agent has permission to run shell commands, that input can become execution. You don't need a poisoned model for that. You need a trusted document with an unclaimed name inside it. The fix cannot be one patched file. Companies using coding agents need ownership checks before package installs, tighter approval rules for shell commands, and logs that show which document caused which action. Package names in public registries should be treated like domains in old documentation: if nobody owns them, somebody eventually will. The old software supply-chain rule still applies here. Trust the official docs, but verify what they point to before you let an agent run it. Also read: Trump Weighs Chip Tariffs Up To 100% That Could Slow The AI Buildout https://startupfortune.com/trump-weighs-chip-tariffs-up-to-100-that-could-slow-the-ai-buildout/ • US Startups Are Quietly Replacing OpenAI and Anthropic With Chinese AI https://startupfortune.com/us-startups-are-quietly-replacing-openai-and-anthropic-with-chinese-ai/ • IKEA Turned 8,500 AI-Displaced Jobs Into $1.4 Billion in New Revenue https://startupfortune.com/ikea-turned-8500-ai-displaced-jobs-into-14-billion-in-new-revenue/