AI Agents in Corporate Networks Are Installing Malware from Hallucinated Docs

Enterprise teams adopting AI coding agents should take note: a new class of supply-chain risk is hiding in plain sight inside AI documentation files. Security researchers have uncovered a vulnerability they call "squatting" — where cybercriminals register abandoned or hallucinated package names found in AI-readable documentation to deliver malware directly through AI agents.

What the Research Found

Researchers analyzed 6,214 live domains belonging to defense contractors, Fortune 500 companies, and major tech firms. They scanned 8,265 llms.txt and llms-full.txt files — the machine-readable docs AI agents use to understand websites — and found 120 domains pointing to unregistered code packages and domain names. These gaps exist for several reasons: human error, renamed packages, copy-paste mistakes, and AI hallucinations in documentation.

How the Attack Works

• Cybercriminals can register the abandoned package names and host malicious code inside them
• If an AI agent has permission to execute shell or package manager commands, it will follow the documentation and install the malicious package
• In the researchers' experiment, a Fortune 500 company began pinging a registered fake package in under one hour
• Claude, OpenAI's Codex, and Nous Research's Hermes were all found to have followed compromised documentation

How to Reduce Your Risk

Organizations should audit their AI documentation files to remove references to unregistered or outdated packages. More critically, AI agents should not be granted blanket permission to execute shell commands based on documentation alone. Until AI systems can better validate documentation sources, restricting autonomous execution is the most immediate defense.

Read the full article on TechRadar