Threat of Unauthorized Codes in Corporate Networks

Unauthorized Codes: The New Silent Threat in Corporate Networks

Imagine accessing a website and, without realizing it, installing malware that disguises itself as legitimate code. It sounds like a movie scene, but it is the reality that many companies are facing. Over 100 websites are inadvertently serving as gateways for dangerous executable content, which is automatically installed when visited by artificial intelligence agents. And we are not talking about just any company: some are giants of the Fortune 500.

The origin of the problem lies in files like llms.txt and llms-full.txt. These files, which should help AI agents understand the structure of a website, are being misconfigured and list non-existent code packages. The danger? An attacker can register these packages and use them to host malware. It’s like leaving the door open and expecting no one to enter.

How Researchers Discovered the Flaw

Researchers from an Israeli startup scanned over 6,000 domains of large companies and found that 120 websites pointed to unregistered packages or domains. To test the vulnerability, they registered some of these names and, in less than an hour, received responses from a Fortune 500 company. This revealed that coding agents like Claude, OpenAI's Codex, and Nous Research's Hermes were involved.

The problem is that these agents treat vendor documents as absolute truth, without questioning. And, with the increasing use of AI, the attack surface only grows. Blind trust in llms.txt and llms-full.txt files is an invitation to disaster.

The Fine Line Between Data and Code

What makes this situation even more concerning is the inability of AI models to distinguish between legitimate instructions and content from untrusted sources. When an AI agent encounters an llms.txt file, it sees a document served over HTTPS, on the official company domain, and has no reason to doubt. If the file instructs to install a package, the agent simply does so, without verifying if the package actually belongs to the company.

This scenario reflects the fundamental limitations of AI. The line that separated data from code is disintegrating. Anything that an agent processes can become a potential instruction. And, as the case of the website clerk.com showed, it only takes one command to appear legitimate for the entire trust system to be compromised.

Security in an AI World

The discovery of these 120 misconfigured files is just the tip of the iceberg. Many of these commands were generated even before the AI era, indicating that the problem is old but is now being exploited in new ways. And, while Big Tech rushes to integrate AI into everything, security seems to be lagging behind.

The issue is not just about the llms.txt and llms-full.txt files. Instructions, whether implicit or explicit, are present almost everywhere an agent traverses. And, with the rush to adopt AI, security may end up being an afterthought.

In the end, this situation not only highlights the flaws in AI security but also reminds us that, in an increasingly digital world, trust must be constantly reevaluated. The future may not be so welcoming, but it will certainly keep security professionals busy. Or perhaps, the AI agents themselves will replace them.