AI Coding Agents Are Installing Unknown/Untrusted Code on Corporate Networks
Researchers scanned thousands of live domains belonging to defense contractors, Fortune 500, and major tech companies and found that over 120 sites had llms.txt files pointing to unregistered code packages or domains. When they registered a sample of those unclaimed names and hosted test packages, AI coding agents processed the files and pulled in that code automatically.
Who should care: General readers · AI governance · Policy