Vendor Documentation Told the Agent to Install a Package Nobody Had Registered, and Fortune 500 Agents Did It

Alon Hertz and a team at a stealth-stage security startup scanned 6,214 live domains belonging to defense contractors, Fortune 500 firms and large technology companies, collected 8,265 llms.txt and llms-full.txt files - the machine-readable guidance files vendors publish for AI agents - and found 120 of them, each on a different site, referencing at least one code package or domain that was not registered to anybody. They registered a sample and hosted benign phone-home packages. The first callback from a Fortune 500 network arrived within an hour, and a few dozen more followed from other large enterprises and startups, with process-lineage evidence implicating Claude, OpenAI Codex and Nous Research Hermes as the installers. Nothing was exploited to make this happen: the agents read the vendor's own documentation, treated it as authoritative, and ran the install command without checking that the package existed or that the vendor owned it. The write-up was published on 27 August 2026 and picked up widely in the first days of September. This is adjacent to but distinct from the hallucinated-name problem already tracked in this feed: here the name is not invented by a model, it is published by a real vendor on a real domain and simply never claimed on the registry, which means it survives review by a careful human as easily as by an agent.

You are affected if you run Not a product defect and no CVE: any agent that installs packages named in fetched documentation without an existence or ownership check. Claude, Codex and Hermes were the three observed doing it..

The control that actually holds is at the registry boundary, not in the agent: require that a dependency an agent introduces resolve to a package that already existed before the agent asked for it, and that its owner be someone you would have accepted. An internal proxy or an allowlisted resolver does this for every agent at once, which matters because the same broken assumption will be re-implemented by every new tool. Second, stop treating an autonomous install as a low-consequence action - the observed blast radius here was a package executing inside a corporate network within an hour, so an approval gate on first-time dependency additions buys back the review that reading documentation was supposed to provide. Third, this is worth checking from the publishing side too, since some of those 120 files belong to companies who now own a documented instruction pointing at a package an attacker can claim: audit your own llms.txt for package and domain references, and register what you reference.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Not a product defect and no CVE: any agent that inst and which version, then enforce a policy on it.