Claude、Codex、Hermes 在企业网络中安装无归属代码
研究人员在企业文档中发现 227 条指向无归属代码的安装命令，这些命令会被 Claude、Codex 和 Hermes 等 AI 代理执行，带来安全风险。
researchers at a stealth startup in israel scanned 6,214 live domains belonging to defense contractors, fortune 500, and big tech companies. they found 8,265 llms.txt and llms-full.txt files, of which 120 pointed to unregistered code packages or domain names. ai agents like claude, codex, and hermes installed unowned code, posing security risks. at least one misconfigured site directed visitors to live malware. this vulnerability occurs when coding agents treat llms.txt and llms-full.txt files as authoritative setup documentation.