Today's briefing

What matters today

AI’s hard problems are moving from the model itself to the systems around it: the instructions agents trust, the work they can access, and the institutions trying to measure or govern their effects. Today’s lineup tracks those operational fault lines—from package commands inside corporate networks to classrooms, labor policy, and infrastructure.

Together with

Lead story / security risk

Claude, Codex and Hermes Executed Unowned Package Commands at Companies

A package name left unclaimed in a company’s AI-readable documentation can later become an attacker-controlled delivery point. Researchers found that coding agents including Claude, OpenAI Codex, and Nous Research’s Hermes executed some instructions that pointed to those unowned packages or domains inside corporate environments.

The researchers examined 6,214 live domains associated with defense contractors, Fortune 500 companies, and large technology firms. They identified 8,265 llms.txt or llms-full.txt files, including 120 files containing 227 commands that referenced nonexistent packages or unclaimed domains. After registering several names and publishing proof-of-concept packages that contacted their server when installed, they received a callback from a Fortune 500 company within an hour, followed by contacts from a few dozen additional organizations.

The risk depends on a specific chain of events: an agent must have permission to run shell or package-manager commands and treat the documentation as authoritative without verifying ownership. In one case, a command on Clerk’s site referenced a package name that was later claimed and used to host live malware. Clerk has fixed the documentation issue.

The findings do not confirm an infection, production-data theft, or compromise at any tested organization. But they turn neglected documentation into a supply-chain control point: publishers can audit every package, command, and domain they name, while enterprises can require explicit approval before an agent installs a dependency or runs a command.