AI Coding Agents Execute Unowned Packages via Malicious Documentation Files
Security researchers found that AI agents including Claude Code, OpenAI Codex, and Nous Research Hermes execute unregistered software packages listed in llms.txt files. Attackers can register these missing package names on PyPI or npm to execute arbitrary malware within enterprise networks.
Impact: High
Why it matters
If you give coding agents shell execution permissions, you must restrict automated package installation from third-party documentation files to prevent supply-chain attacks.
TL;DR
- 01Coding agents treat third-party documentation and llms.txt content as trusted instructions.
- 02Unregistered package names in docs create an immediate slopsquatting attack surface.
- 03Standard EDR and network proxies do not block agent-initiated package installs.
Key facts
- Domains Scanned
- 6,214 live domains
- Misconfigured LLM Files
- 120 sites (227 unowned commands)
- Targeted Registries
- npm, PyPI
The Mechanism Behind llms.txt Supply-Chain Exploits
AI agents rely heavily on llms.txt and llms-full.txt standard files to parse repository structure and setup instructions. When an agent operating in execution mode encounters shell commands such as pip install internal-tool or npx package-name, it executes them without validating registry ownership.
Researchers scanned 6,214 domains and found 227 commands pointing to non-existent packages or expired domains. By registering proof-of-concept packages on public registries, researchers captured live connection beacons from coding tools like Claude Code, OpenAI Codex, and Hermes operating inside enterprise networks.
Real-World Malware and EDR Blindspots
Unlike standard dependencies listed in package.json, commands invoked via npx or transient shell prompts bypass standard security scanners. In the case of clerk.com, a typo or placeholder reference led to an attacker claiming npx clerk-next-fix-auth-protection on npm to host live malware.
Endpoint Detection and Response (EDR) agents fail to trigger alerts because the request originates from a legitimate developer terminal tool executing a standard command against pypi.org or registry.npmjs.org.
Try it in 2 minutes
# Prevent agents from auto-executing package installs by enforcing dry-run flags or prompt confirmation
claude config set auto_approve_tools "[]"bash
✓ When to use
- When setting up Claude Code, Codex, or custom sub-agents with bash access in corporate networks.
✕ When NOT to use
- When running AI agents in read-only sandbox environments without network access.
- When agents do not have permission to execute terminal commands.
What to do today
- Disable unprompted shell execution in Claude Code and Codex settings.
- Audit public llms.txt files in your repositories for unregistered package names.
- Restrict package manager commands in agent environments using explicit execution allowlists.
Sources