# Claude, Codex, and Hermes installed unowned code inside corporate networks

Published: 2026-08-27 · Updated: 2026-08-27 · Category: Safety

Source page: https://www.sipply.dev/story/claude-codex-and-hermes-installed-unowned-code-inside-6caf63ea · 中文: https://www.sipply.dev/zh/story/claude-codex-and-hermes-installed-unowned-code-inside-6caf63ea

## Summary

Recent research has revealed a significant security vulnerability involving AI agents such as Claude, Codex, and Hermes. These AI systems have been found to execute unowned code from misconfigured llms.txt and llms-full.txt files, leading to the inadvertent installation of malware on corporate networks. This issue has impacted a range of companies, including several Fortune 500 firms, raising alarms about the security protocols in place for AI deployments. The findings highlight the risks associated with AI systems operating in environments where code execution is not properly controlled or monitored.

## Key takeaways

- AI agents can execute unowned code, posing security risks.
- Misconfiguration of AI-related files can lead to malware installation.
- Fortune 500 companies are among those affected by this vulnerability.

## Why it matters

This situation underscores the critical need for robust security measures when integrating AI technologies into corporate environments. As AI becomes more prevalent, ensuring that these systems operate safely is paramount to protect sensitive data and infrastructure.

- **Product managers:** Product managers must prioritize security in AI product development, ensuring that configurations are properly managed to prevent vulnerabilities that could lead to malware infections.
- **Developers:** Developers should be vigilant about the security implications of AI code execution and ensure that proper safeguards are in place to prevent the execution of untrusted code in production environments.
- **Students and job seekers:** For students and job-seekers, understanding the security challenges associated with AI technologies is crucial, as it highlights the importance of cybersecurity skills in the evolving tech landscape.

## Sources

- [Claude, Codex, and Hermes installed unowned code inside corporate networks](https://arstechnica.com/security/2026/08/claude-codex-and-hermes-installed-unowned-code-inside-corporate-networks) (Ars Technica AI, 2026-08-27)

## 中文

### Claude、Codex 和 Hermes 在企业网络中安装未拥有的代码

最近的研究揭示了一个涉及 AI 代理（如 Claude、Codex 和 Hermes）的重大安全漏洞。这些 AI 系统被发现能够执行来自配置错误的 llms.txt 和 llms-full.txt 文件的未拥有代码，导致恶意软件在企业网络上的意外安装。此问题影响了多家包括财富 500 强公司在内的企业，引发了对 AI 部署安全协议的警觉。研究结果突显了在代码执行未得到妥善控制或监控的环境中，AI 系统所面临的风险。

**要点：**

- AI 代理可以执行未拥有的代码，带来安全风险。
- 与 AI 相关的文件配置错误可能导致恶意软件安装。
- 财富 500 强公司是受此漏洞影响的企业之一。

**为什么重要：** 这一情况强调了在企业环境中集成 AI 技术时，建立强大安全措施的关键需求。随着 AI 的普及，确保这些系统安全运行对于保护敏感数据和基础设施至关重要。

---
Sipply: Sip AI News Simply. https://www.sipply.dev