How AI Coding Agents Fell Into the Unclaimed-Code Trap

Introduction

A new machine-readable documentation convention is becoming an unexpected software supply-chain entry point. Researchers scanned 6,214 live domains associated with defense contractors, Fortune 500 companies, and major technology firms. Among 8,265 llms.txt and llms-full.txt files, 120 files referenced package names or domains that were not registered or otherwise unclaimed. Together, the files contained 227 installation commands or domain references.

The danger appears when a coding agent treats an official-looking document as an authoritative setup guide. If the agent can run shell commands, a familiar pip install, npm install, or npx instruction may move directly from retrieved text into a corporate development environment.

Key findings

• Unclaimed names can be taken over. The files pointed to nonexistent packages on registries such as PyPI and npm. An attacker could register the name first and upload a malicious package. An abandoned domain could likewise be registered and used to host hostile instructions.
• The proof of concept reached real companies. The researchers registered a small number of names and hosted packages that called back when executed. They received a response from a Fortune 500 company within an hour, followed by additional callbacks from other large companies and startups. Process information showed that coding agents including Claude, OpenAI Codex, and Nous Research Hermes were involved in some installation chains.
• One case involved live malware. A file on the legitimate Clerk website included npx clerk-next-fix-auth-protection. The previously unclaimed npm name was later used to distribute live malware, and Clerk has since fixed the issue. The available material does not establish whether the confusion caused an infection.
• Conventional defenses may see normal behavior. To an endpoint or proxy, the activity can resemble an ordinary developer installing a package from an approved registry. The parent process is also an AI tool deliberately installed by the company. The missing control is upstream: verifying whether the retrieved instruction should be executed at all.

Why it matters

The purpose of llms.txt is to help agents understand a website’s structure and content. Yet the same format can make descriptive text look like operational configuration. Language models do not reliably distinguish a command typed by a user from an instruction encountered in a web page or vendor document. Without explicit controls, they may not verify package ownership, publisher identity, or whether a referenced domain is still controlled by the legitimate organization.

Trust can also travel through third parties. An agent may use a partner’s documentation, a vendor SDK guide, or a community project rather than the company’s own site. If any link in that chain points to an unclaimed resource, the risk can cross organizational boundaries.

Companies should treat agent-read documentation as untrusted input, not as an automatically executable setup file. Package ownership, publisher identity, versions, and provenance should be checked before installation. Agents should receive narrowly scoped command and network permissions, while new dependencies should go through approval or sandbox testing. Website owners also need to remove stale commands and periodically check the registration status of packages and domains.

The central lesson is broader than one file convention: as agents turn more natural-language content into actions, every document they can retrieve becomes a potential execution surface. A clear separation between reading and running is now a basic security requirement.

Source: Ars Technica AI