AI Agents Are Installing Unregistered Code on Corporate Networks

Bruce Schneier draws attention to research from an Israeli startup operating in stealth mode that serves as a reminder of a simple truth: AI coding agents cannot yet be considered trustworthy.

What they found

The researchers scanned 6,214 active domains belonging to defense contractors, Fortune 500 companies, and major technology corporations. On these sites they discovered 8,265 llms.txt and llms-full.txt files — many sites hosted both versions at once. These files are meant to serve as “documentation for machines”: they tell AI agents where to fetch code from and which resources to rely on.

The problem is that 120 such files, each on a separate site, referenced software packages or domain names that simply weren't registered by anyone. In other words, the agent's instructions pointed into the void — and that void could be filled by anybody.

The experiment

To test the consequences, the researchers bought up several of the orphaned names and placed packages there that made any machine running them reach out to the authors' server. The response came quickly: within an hour a Fortune 500 company checked in. Over time several dozen more “phone-home” calls accumulated — from other large corporations as well as startups.

The beacon in the packages recorded the chain of parent processes that had spawned the installation. That is what exposed the culprits: behind the requests stood AI agents, among them Claude, OpenAI's Codex, and Nous Research's Hermes. Anthropic, OpenAI, and Nous Research had not responded to requests for comment by the time of publication.

Why it's dangerous

Schneier draws a direct parallel to supply-chain attacks in the vein of SolarWinds: holes like these will inevitably start to be exploited. It's enough to buy up in advance a domain referenced by someone else's llms.txt — and a malicious package will drive itself into the corporate network at the hands of an obliging agent.

One of the researchers, Alon Herz, frames the essence of the problem this way: the trust model is broken. Agents treat a vendor's documentation as gospel and don't question it — nor, for that matter, do the humans overseeing them. Meanwhile agentic AI is spreading across every layer of infrastructure: SaaS, cloud, endpoint devices. The more of them there are, the wider the surface for supply-chain attacks, and today's defenses simply don't cover it.

A blog commenter aptly noted the irony of the original phrasing: “not yet trustworthy” is a rather curious way to describe what's going on.

Source: Schneier on Security