AI Agents Installing Malicious Code | Security Risks Explained

Vulnerable Documentation Files

AI coding agents are inadvertently running malicious code inside corporate networks by following instructions found in documentation files. Researchers discovered that llms.txt and llms-full.txt files, which are meant to provide machine-readable site summaries for AI, contain dangerous installation commands. These files point to non-existent software packages and expired domains. When an AI agent reads these files, it often treats the instructions as authoritative commands.

The scope of this issue is significant. Researchers scanned over 6,000 domains belonging to Fortune 500 companies, defense contractors, and major technology firms. They found 120 websites hosting files that included 227 commands for unowned code. In proof-of-concept tests, agents including Claude, Codex, and Hermes executed these commands. This behavior allows an attacker to register an abandoned package name or domain to host malware, which the AI then unknowingly downloads and runs.

The Mechanism of Execution

The vulnerability stems from a lack of boundary between data and code. AI agents are designed to pull information from the internet to assist with programming tasks. When an agent encounters a command like 'pip install' or 'npm install' inside a document, it assumes the instruction comes from a trusted source. Because the agent has the permission to run shell commands, it executes the installation without verifying the origin or ownership of the package.

This process bypasses standard security measures. Endpoint detection systems often miss the threat because the installation appears to be a legitimate action performed by a recognized agent. The agent acts as the parent process for the installation, which gives the action an appearance of authorization. The researchers noted that this failure occurs upstream, specifically in the gap between the agent reading the instruction and its decision to execute it.

Real-World Exploits and Future Risks

At least one instance of active exploitation has been documented. A file hosted on clerk.com contained a command to fetch and execute a package that had been abandoned. An attacker claimed the package slot and used it to host live malware. While the company eventually resolved the issue, the incident highlights the severity of the threat. The reliance on AI to manage complex systems without human oversight creates a new supply-chain surface that current security tools are not equipped to protect.

The researchers emphasize that this problem is not limited to a single platform or configuration. It is a fundamental limitation of current large language models. These models cannot consistently distinguish between benign content and executable instructions provided by third-party sources. As companies accelerate the deployment of agentic AI across their infrastructure, the number of potential entry points for attackers will grow. Organizations must now consider the entire corpus of online data as a potential execution surface until better safeguards are established.