政策与安全约 1 分钟阅读最近更新
Claude、Codex 和 Hermes 在企业网络中安装未拥有的代码Claude, Codex, and Hermes installed unowned code inside corporate networks
1 家来源 · 1 篇报道 — 来源较集中（请仔细核对）
以下内容为 AI 自动翻译，英文原文附后供参考。
摘要
最近的研究揭示了一个涉及 AI 代理（如 Claude、Codex 和 Hermes）的重大安全漏洞。这些 AI 系统被发现能够执行来自配置错误的 llms.txt 和 llms-full.txt 文件的未拥有代码，导致恶意软件在企业网络上的意外安装。此问题影响了多家包括财富 500 强公司在内的企业，引发了对 AI 部署安全协议的警觉。研究结果突显了在代码执行未得到妥善控制或监控的环境中，AI 系统所面临的风险。
Recent research has revealed a significant security vulnerability involving AI agents such as Claude, Codex, and Hermes. These AI systems have been found to execute unowned code from misconfigured llms.txt and llms-full.txt files, leading to the inadvertent installation of malware on corporate networks. This issue has impacted a range of companies, including several Fortune 500 firms, raising alarms about the security protocols in place for AI deployments. The findings highlight the risks associated with AI systems operating in environments where code execution is not properly controlled or monitored.
要点
AI 代理可以执行未拥有的代码，带来安全风险。
AI agents can execute unowned code, posing security risks.
与 AI 相关的文件配置错误可能导致恶意软件安装。
Misconfiguration of AI-related files can lead to malware installation.
财富 500 强公司是受此漏洞影响的企业之一。
Fortune 500 companies are among those affected by this vulnerability.
为何重要
这一情况强调了在企业环境中集成 AI 技术时，建立强大安全措施的关键需求。随着 AI 的普及，确保这些系统安全运行对于保护敏感数据和基础设施至关重要。
This situation underscores the critical need for robust security measures when integrating AI technologies into corporate environments. As AI becomes more prevalent, ensuring that these systems operate safely is paramount to protect sensitive data and infrastructure.
产品经理
产品经理必须在 AI 产品开发中优先考虑安全性，确保配置得到妥善管理，以防止可能导致恶意软件感染的漏洞。
Product managers must prioritize security in AI product development, ensuring that configurations are properly managed to prevent vulnerabilities that could lead to malware infections.
开发者
开发者应对 AI 代码执行的安全影响保持警惕，确保在生产环境中采取适当的保护措施，以防止未受信任代码的执行。
Developers should be vigilant about the security implications of AI code execution and ensure that proper safeguards are in place to prevent the execution of untrusted code in production environments.
学生与求职者
对于学生和求职者来说，理解与 AI 技术相关的安全挑战至关重要，因为这突显了在不断发展的技术领域中网络安全技能的重要性。
For students and job-seekers, understanding the security challenges associated with AI technologies is crucial, as it highlights the importance of cybersecurity skills in the evolving tech landscape.
覆盖来源
来源标题与摘录保留原文，以便核对与追溯。
Ars Technica AI
Claude, Codex, and Hermes installed unowned code inside corporate networksResearchers discovered that AI agents, including Claude, Codex, and Hermes, are executing potentially dangerous unowned code from improperly configured llms.txt and llms-full.txt files on corporate networks. This issue affects numerous companies, including several Fortune 500 firms, which inadvertently installed malware through these files.