Claude, Codex and Hermes Ran Unowned Package Commands Inside Corporate Networks

A package name left unclaimed in a company’s AI-readable documentation can become an attacker-controlled delivery point later. Researchers showed that coding agents including Claude, OpenAI Codex, and Nous Research’s Hermes executed some of those instructions inside corporate environments, turning an ordinary documentation error into a software-supply-chain exposure.

The researchers examined 6,214 live domains associated with defense contractors, Fortune 500 companies, and large technology firms. They found 8,265 llms.txt or llms-full.txt files, including 120 files on separate sites containing 227 commands that referred to nonexistent packages or unclaimed domains. These files are machine-readable website summaries intended for AI systems.

An empty name became executable infrastructure

The test began with names that nobody owned. Researchers registered several of them and published proof-of-concept packages programmed to contact their server when installed. Within an hour, one package received a response from a Fortune 500 company; a few dozen additional organizations later contacted the experimental packages.

npx clerk-next-fix-auth-protection

The callback data and process telemetry indicated that Claude, Codex, and Hermes were involved in executing some installation commands. The issue is not simply that an agent reads a bad page: the dangerous sequence requires an agent with permission to run shell or package-manager commands to treat that documentation as authoritative without checking whether the named package is still owned by its supposed publisher.

The Clerk example shows the live version

One misconfigured file on clerk.com carried the npx command shown above. Unlike a normal dependency installation, npx can fetch a package and execute its exposed binary without adding it to a project’s dependency manifest. Someone later claimed the previously empty package name and used it to host live malware; Clerk has since fixed the documentation problem.

That case is evidence of an active malicious package, rather than only a laboratory callback. But it does not answer the most consequential operational question: it remains unclear whether the Clerk confusion caused infections. The testing likewise demonstrates that experimental packages were reachable and executed, not that production data was taken or any tested organization suffered a confirmed infection.

The next control sits before execution

The problematic references may have several origins. Some appeared in older, non-AI website files before this documentation convention emerged, pointing to human-authored mistakes; researchers also suspect that some entries may have been generated by AI. Either path leaves the same exposure once a name is abandoned and claimable.

The practical response has two parts: publishers can audit every package, command, and domain named in these files, while organizations can require explicit approval before an agent installs a dependency or runs a command. The findings do not show which approval controls were enabled in the tested environments, so the effect of a more restricted configuration remains unresolved.