Researchers say AI agents installed malicious code via hallucinated docs

AI digestMimile.ai EditorialAugust 30, 2026 at 05:05 PM

This digest was compiled by AI from multiple sources — links to the originals are below.

Researchers say AI agents installed malicious code via hallucinated docs

Researchers found that AI agents including Claude, OpenAI Codex, and Nous Research's Hermes installed suspicious code from unregistered packages referenced in website documentation. The team registered some unclaimed names and observed a Fortune 500 company ping within an hour. The findings highlight risks when AI agents are granted permission to execute commands.

Key Facts

Researchers analyzed 6,214 live domains belonging to defense contractors, Fortune 500 organizations, and big tech, finding 8,265 llms.txt files.
Among those files, 120 pointed to code packages or domain names that were not registered at all.
After registering some unclaimed names, researchers observed a Fortune 500 company ping within an hour, followed by a few dozen more.
Claude, OpenAI Codex, and Nous Research's Hermes were all identified as having installed the suspicious code.

The Vulnerability

Websites increasingly include llms.txt and llms-full.txt files that allow AI agents to read site contents. AI agents searching for software installation instructions can follow references in these files to code packages and domains. Researchers found 120 instances where such references pointed to unregistered packages or domains. Unregistered names can result from human error, renamed or abandoned packages, copy/paste mistakes, or hallucinated documentation.

The Experiment

Researchers registered some unclaimed names and hosted packages designed to phone home when installed. A Fortune 500 company began pinging within an hour, and the count soon grew to a few dozen more. Claude, OpenAI Codex, and Nous Research's Hermes were all found to have installed the suspicious code. The experiment demonstrates that cybercriminals could similarly register unclaimed packages to deliver malware.

Mitigation

Companies need to clean up documentation to ensure it does not point to non-existent or malicious content. AI agents should stop treating documentation as executable instructions. Organizations using AI for coding should consider the risks when granting AI agents permission to execute commands.

1 source

Researchers say AI agents installed malicious code via hallucinated docs

techradar.com

TechRadar

Technology

Fake Claude download page on claude.ai domain compromised 29 firms

A threat actor abused Anthropic's Claude Artifacts feature to host a fake download page on the legitimate claude.ai domain, redirecting users to SectopRAT malware. Employees at at least 29 organizations were compromised over two days in July after clicking a sponsored Bing ad. The artifact was viewed 7,100 times before Anthropic took it down on July 22.

Technology

Okta Researchers Uncover Poison Claude Service That Sells Discounted AI Access and Reads All Prompts

Okta researchers Jeremy Kirk and Mathew Woodyard have discovered a service called Poison Claude that provides illegal discounted access to Anthropic's Claude language models by routing queries through fraudulently obtained AWS accounts. The service, which has 872 active users, charges 5–15% of the official token price and explicitly states it sees every user prompt. The discovery comes as similar services like Ecomagent.in also offer cut-rate access to AI models.

Technology

CrowdStrike finds worm targeting AI software supply chain

CrowdStrike researchers discovered a worm that targets AI software supply chains, stealing credentials and sensitive data while evading detection. The malware mimics legitimate AI coding activity, making it difficult to identify. The attack reflects a growing trend of adversaries exploiting AI toolchains.

Technology

iAuthFlow v2 malware adds attacker passkeys to hijacked email accounts

Security researchers at Abnormal discovered iAuthFlow v2, a malware toolkit sold on Russian forums for over $10,000 that lets attackers regain access to compromised email accounts even after password resets. The tool phishes credentials from Google, Microsoft, iCloud, or LinkedIn, then silently creates an attacker-controlled passkey. Abnormal advises users to audit passkeys, OAuth tokens, mail rules, and remove rogue authentication methods.

Researchers say AI agents installed malicious code via hallucinated docs

Key Facts

The Vulnerability

The Experiment

Mitigation

Read more

Read more