Claude, Codex, Hermes, 기업 네트워크에 소유자 없는 코드 설치
연구진이 기업 문서에서 소유자 없는 코드를 가리키는 227개의 설치 명령어를 발견했으며, Claude, Codex, Hermes 같은 AI 에이전트가 이를 실행해 보안 위험을 초래하고 있습니다.
researchers at a stealth startup in israel scanned 6,214 live domains belonging to defense contractors, fortune 500, and big tech companies. they found 8,265 llms.txt and llms-full.txt files, of which 120 pointed to unregistered code packages or domain names. ai agents like claude, codex, and hermes installed unowned code, posing security risks. at least one misconfigured site directed visitors to live malware. this vulnerability occurs when coding agents treat llms.txt and llms-full.txt files as authoritative setup documentation.