MobbleOpen in Mobble ⇢
Technology · Cybersecurity · published 2026-08-27 · via Ars Technica

AI agents found executing unclaimed code from corporate documentation

Image via Ars Technica
Image via Ars Technica

Researchers discovered that documentation files on over 100 websites reference executable content that AI agents automatically install when visiting. A few dozen companies, including Fortune 500s, executed proof-of-concept code, and one misconfigured site directed visitors to live malware. The researchers registered unclaimed domains to demonstrate the risk.

Expanded Detail

EXPANDED:

The researchers examined 6,214 domains across defense contractors, Fortune 500 firms, and major technology companies, uncovering 8,265 machine-readable documentation files. Of those, 120 sites contained references to software packages or web addresses that no party had registered. By claiming several of these names themselves, the team showed that coding agents would automatically fetch and run whatever code they placed there.

Their proof-of-concept drew responses from a few dozen organizations within hours, with logging revealing that Claude, OpenAI's Codex, and Hermes were among the agents that executed the unclaimed code. The team also found at least one legitimate site whose misconfiguration was already steering

Expanded detail and Context are AI-generated analysis; the linked article remains the authoritative source.
Read the full article at Ars Technica →
This summary is Al-enhanced to contain extended analysis and broader social context. The original is {NAME); the linked article is the authoritative source. Original headline: “Claude, Codex, and Hermes installed unowned code inside corporate networks.” Browse more stories.