Artificial intelligence agents designed to assist in software development, including Claude (developed by Anthropic), Codex (from OpenAI), and Hermes (from Nous Research), have the capability to install potentially dangerous code within large companies' networks. This security issue was identified by an Israeli startup.
The incident occurs because these AIs interpret instructions found on the internet and execute commands directed at software that has already been discontinued. This behavior allows attackers to register fake packages and take control of these 'shortcuts,' paving the way for the invasion of corporate infrastructures.
As detailed in an article on the ArsTechnica website, the vulnerability resides in files named llms.txt and llms-full.txt. These files function to summarize website content so that robots and virtual assistants can quickly absorb and understand the information. The risk arises when certain pages contain incorrect or outdated guidelines; since AI agents do not filter what they read, this text is processed as a direct order, resulting in the silent execution of harmful code.
The discovery was made by a team of cybersecurity experts who investigated the behavior of AIs while browsing and consuming technical data online. The analysts examined over 6,000 active domains linked to technology giants and defense industries.
During the review of 8,265 files intended to guide AI tools, the team located 120 documents that ordered the installation of packages or tools that were no longer available or whose domains had been abandoned. The survey pointed to 227 vulnerable commands and recorded numerous accesses, with tracking indicating that the downloads originated from virtual assistants of code operating with elevated privileges.
Researcher Alon Hertz, one of the members involved in the study, explained that the current paradigm of AI trust is compromised. He stated that the tools treat documentation 'as unquestionable truth.' Due to the integration of virtual agents into multiple layers of business services, the area exposed to cyberattacks has grown drastically, exceeding the capabilities of existing protections.
The difficulty in preventing this intrusion is related to a technical limitation inherent in current AIs: large language models (LLMs) cannot distinguish between merely reading descriptive text and an execution command. For the machine, any assimilated data turns into a valid instruction. When accessing an official page, the artificial intelligence that reads 'install tool X' simply complies with the order without verifying the integrity of that package.
For this reason, conventional security systems, such as firewalls and network antivirus, do not generate alerts. When the attack occurs, corporate defenses only perceive an authorized tool belonging to the company accessing a website, simulating the work of a common developer. The flaw originates in the source of the information, making it invisible to traditional protective mechanisms. This invisibility imposes on information security professionals the challenge of making tools cease blind trust in all processed web content.