Claude、Codex 和 Hermes 在企业网络中安装了无人认领的代码

超过 100 个网站的文档文件引用了可能具有危险性的可执行内容，而许多 AI Agent 在访问这些内容时会自动将其安装。一些公司——其中包括数十家企业及部分《财富》500 强公司——执行了概念验证代码。至少有一个配置错误的网站正在将访问者，无论是人类还是 AI，引导至仍在活动的恶意软件。

这些潜在危险内容存在于 llms.txt 和 llms-full.txt 文件中。这是网站用于提供站点内容及其高层级结构机器可读摘要的一项新兴惯例。这些文件相当于 AI 领域的 robots.txt 标准，后者用于指示搜索引擎应如何索引网站内容。用于帮助 Web 开发者的 Google Lighthouse 工具在这里提供了更多说明。配置正确的 Cloudflare llms.txt 和 llms-full.txt 文件可分别在这里和这里查看。

研究人员如何发现这一问题

一家以隐身模式运营的以色列初创公司的研究人员，扫描了 6,214 个仍在运行的域名，这些域名属于国防承包商、《财富》500 强企业和大型科技公司。他们发现了 8,265 个 llms.txt 和 llms-full.txt 文件（许多网站同时托管了 llms.txt 和 llms-full.txt 文件），其中 120 个文件分布在 120 个不同网站上，并分别指向一个或多个未注册的代码包或域名。

为了测试 AI Agent 处理此类文件时会发生什么，研究人员注册了少量尚未被认领的名称，并托管了可使任何执行它们的机器向其服务器发起连接的软件包。在一小时内，研究人员便收到了来自一家《财富》500 强公司的回连响应。随着时间推移，他们又收到了数十个回连，其中一些来自更多《财富》500 强企业，另一些则来自初创公司。

他们的信标程序还记录了启动每次安装操作的父进程链，最终显示，包括 Claude、OpenAI 的 Codex 以及 Nous Research 的 Hermes 在内的编程 Agent 均参与其中。截至发稿时，Anthropic、OpenAI 和 Nous Research 尚未回应置评请求。

“这一信任模型已经失效，”研究人员之一 Alon Hertz 在接受采访时写道。“Agent 将供应商文档视为绝对可信的事实来源，不会提出质疑——监督它们的人类也是如此。Agentic AI 的使用正在爆发式增长，Agent 正扩展至各个层面：SaaS、云端和终端。随着它们数量增加，供应链攻击面也在扩大，而当前的防护措施并未覆盖这一问题。”

Documentation files on more than 100 websites are referencing potentially dangerous executable content that gets installed automatically when visited by many AI agents. A few dozen companies, some of them Fortune 500s, are among those that executed proof-of-concept code. At least one misconfigured site is directing visitors, human or AI, to live malware.

The potentially dangerous content is in llms.txt and llms-full.txt files, an emerging convention websites employ to provide machine-readable summaries of the site’s content and its high-level structure. These files are the AI equivalent of the robots.txt standard that instructs search engines how to index the site’s content. Google Lighthouse, a tool for helping web developers, has more here. Correctly configured llms.txt and llms-full.txt files for Cloudflare are here and here.

How the researchers found it

Researchers at a stealth startup in Israel scanned 6,214 live domains belonging to defense contractors, Fortune 500, and Big Tech companies. Of the 8,265 llms.txt and llms-full.txt files they found (many sites hosted both an llms.txt and an llms-full.txt file), 120 of them, each on a different site, pointed to one or more code packages or domain names that weren’t registered. To test what happens when an AI agent processes such files, the researchers registered a handful of the unclaimed names and hosted packages that caused any machine executing them to reach out to their server. Within an hour, the researchers received a phone-home response from a Fortune 500 company. Over time, they got a few dozen more, some from more Fortune 500 companies and others from startups. Their beacon also recorded the chain of parent processes that spawned each install, ultimately revealing that coding agents, including Claude, OpenAI’s Codex, and Nous Research’s Hermes, were involved. Anthropic, OpenAI, and Nous Research did not respond to requests for comment by the time of publication.

“The trust model is broken,” Alon Hertz, one of the researchers, wrote in an interview. “Agents treat vendor docs as ground truth and don’t question them—and neither do the humans supervising them. Agentic AI usage is exploding, and agents are spreading across every layer—SaaS, cloud, endpoint. As they multiply, so does the supply-chain surface, and today’s guards don’t cover it.”