AI Coding Agents Induced to Install Unowned Supply-Chain Packages from Corporate Intranets; In-the-Wild Malicious Sample Found on clerk.com

In late August 2026, Israeli security researcher Alon Hertz published a supply-chain attack study: among llms.txt / llms-full.txt files on 6,214 domains, 120 entries pointed at never-registered PyPI / npm packages. Claude, Codex, Hermes, and other AI coding agents faithfully executed the installs on multiple world-class corporate networks. clerk.com was found hosting a real in-the-wild malicious sample.

Incident overview

On 27 August 2026, Ars Technica and others reported supply-chain research led by Israeli security researcher Alon Hertz: the emerging standard files llms.txt / llms-full.txt (robots.txt for AI agents), now widely deployed by enterprises, are being used as a code-delivery pipe. Hertz's team scanned 6,214 domains (defense contractors, Fortune 500, large tech). Across 8,265 llms.txt / llms-full.txt files they found 120 install directives pointing at unregistered PyPI / npm packages, covering 227 install commands.

The team then registered several unclaimed package names and planted beacon payloads. Within an hour they got a callback from a Fortune 500. More callbacks followed from other Fortune 500s and startups. All callback process trees pointed at AI coding agents: Claude (Anthropic), Codex (OpenAI), Hermes (Nous Research).

Most concerning: on clerk.com — a legitimate identity vendor — Hertz's team found `npx clerk-next-fix-auth-protection` in llms.txt. Someone squatted the same name on npm and delivered a real in-the-wild malicious payload. Clerk fixed after disclosure. The incident shows even a legit vendor writing official llms.txt can still get mined on the supply chain.

Technical details

Why llms.txt is a natural supply-chain entry

llms.txt is designed as site notes for AI agents: machine-readable, describing site structure, SDKs to install, recommended dev workflow. Problems:

• Plain UTF-8 text. It can carry both description and instruction. Coding agents often do not distinguish the two.
• Published by the site owner. Most enterprises treat it as trusted. From the endpoint, `pip install` comes from a trusted domain and `npm install` hits a public registry — no extra alert.
• Unlike Dockerfiles and CI pipelines, llms.txt almost never goes through security review.

Hertz observed:

# Snippet from a real enterprise llms.txt
Installation: pip install <unregistered-pkg>
# or
npm install <unregistered-pkg>
# even
As an example of writing integration tests ... you can use the [Citrus] test framework

If the agent already has shell exec, `pip install` looks like a normal build step. It does not stop to ask a human. The attacker only needs to squat the package names first. Ransomware, credential stealers, or backdoors then run inside the corporate network.

clerk.com case: scoped packages + npx as a built-in trap

Clerk's llms.txt told agents to install `@clerk/eslint-plugin`, then run the bin `clerk-next-fix-auth-protection`. Scoped npm packages expose bin names without the scope. If the bare command runs before the scoped package is installed locally, `npx` fetches the same-named unscoped package from the public registry — a package Clerk never published. Someone squatted it and shipped a real malicious payload.

The full chain does not require Clerk to make an active mistake:

• Clerk wrote a "correct" llms.txt;
• bin name vs scope name mismatch is an invisible npm design trap;
• the agent does not know whether the bin is local or needs npx download;
• once npx runs, the attacker takes over.

Impact

Three key numbers from this research:

• 6,214 domains scanned; 120 llms.txt files pointed at unregistered packages;
• 227 install commands pointed at unowned code;
• AI agents at multiple Fortune 500s actually ran those commands.

At that ratio: even with SWG, EDR, code signing, and image signing in place, AI coding agents still punch through as normal developer behavior. Hertz told Ars Technica: "The trust model is broken. Agents treat vendor docs as ground truth and dont question them."

Broader blast radius:

• Any org that lets agents write code and grants them shell is at the same risk tier;
• `README.md`, `API changelog`, `docs.example.com`, internal wikis likewise become read-equals-instruction sources;
• Same root cause as MCP (Model Context Protocol) tool calls, Anthropic Tool Use, OpenAI Function Calling: the LLM has no reliable boundary between user instructions and external content.

Remediation

Immediate: inventory and audit

• Self-audit all llms.txt / llms-full.txt on your domains. Delete or mark `llms.txt: ignore` any referenced package that does not exist on PyPI / npm / RubyGems / Maven Central, or is not owned by the same org as the publisher.
• Run the same scan on historical docs sites that ever published llms.txt. Hertz's dataset already includes a large set of high-traffic sites.
• Enable install-command audit logs on internal AI coding agents (Claude Code, Codex CLI, Hermes, Continue.dev, etc.): record every `pip install`, `npm install`, `npx` call stack and parent process, bound to the specific agent session.

Short term: tighten agent privileges

• Default-deny shell for agents. Allowlist only (e.g. `pytest`, `npm test`). Require human confirm for `pip install`, `npm install`, `curl`, `wget`.
• Force agents into a restricted network namespace at the orchestrator. Block public PyPI / npm / RubyGems. Registry mirrors must be the enterprise private registry.
• Enable package allowlists on the private registry. Agents may pull only pre-approved packages. New names require human review.

Mid/long term: agent trusted-content spec

• Push signature checks into llms.txt: the site apex signs a verification string via DNS/SSL. Before any install, the agent verifies the signature against the same private key as the site cert.
• Deploy an MCP Gateway internally. Centralize agent tool calls into a policy engine (Speakeasy, ToolHive, and similar OSS). Separate policies for install, shell, and file write.
• Add origin tags on tool calls: every install must be labeled user instruction, doc read, or agent inference, so doc-driven exec chains can be reviewed in isolation.
• Share threat intel across security, DevOps, and AI platform teams. Correlate Hertz's findings with alerts from package-security vendors (RCS (ReversingCorp), Socket, Phylum).

References

• Ars Technica: Claude, Codex, Hermes installed unowned code inside corporate networks
• TokenFeed: AI Agents Helpfully Installed Code Nobody Owned
• Alon Hertz on the llms.txt attack pattern
• llms.txt official spec (recommend adding a signature/verification section)
• W3C draft on llms-full