Security researchers show AI coding agents (Claude, Codex, Hermes) auto-execute unclaimed code referenced in llms.txt files, triggering callbacks from dozens of real companies

A stealth Israeli security startup scanned 6,214 domains, including defense contractors, Fortune 500s, and Big Tech, and found 8,265 llms.txt/llms-full.txt files. Of these, 120 referenced code packages or domain names that were unregistered. The researchers registered some of the unclaimed names as a proof-of-concept beacon and, within an hour, got a callback from a Fortune 500 company, followed by callbacks from a few dozen more organisations over time, indicating that AI coding agents (Claude, Codex, Hermes) had automatically fetched and executed that unowned code inside real corporate networks.

This is a live demonstration of dependency confusion applied to a new attack surface: the llms.txt convention that AI coding agents read to find instructions and code references. Any enterprise using these agents for coding tasks is potentially exposed if their own or a linked llms.txt file points to a package or domain nobody has claimed, since an attacker could register it and have the agent execute arbitrary code inside the network. The practical fix is immediate and cheap: audit llms.txt files for dangling references, claim any unclaimed namespaces, and sandbox what coding agents are allowed to fetch and run.

The entire account runs through Ars Technica citing an anonymous, unnamed startup with no published paper, methodology, or list of affected companies, so the "dozens of Fortune 500s" and "live malware" claims cannot be independently checked. Anthropic, OpenAI, and Nous Research all declined to comment, meaning there is no vendor confirmation of the parent-process chains said to identify their specific products as the executors. The underlying vulnerability class, dependency confusion, is well known; what is new is only its application to llms.txt, not the concept itself.

1. 01Whether the unnamed Israeli startup publishes a paper, methodology, or named list of affected organisations (currently zero primary sources or links are available, so all figures rest on Ars Technica's secondary account)
2. 02Whether Anthropic, OpenAI, or Nous Research issue technical responses or ship mitigations, e.g. sandboxing changes, package-existence checks, or llms.txt validation, in their coding agent products
3. 03Whether any registrar, npm/PyPI, or Cloudflare-style intermediary introduces controls (namespace reservation, llms.txt linting) that would close this specific dependency-confusion route, and whether independent researchers replicate the 120-unclaimed-reference finding on a different domain sample