AI Coding Agents Are Installing Unknown/Untrusted Code on Corporate Networks
Summary
Researchers discovered that AI coding agents, including Claude, Codex, and Hermes, have been installing untrusted and unregistered code packages on corporate networks. When researchers registered some of these unclaimed domains, they received 'phone-home' responses from machines executing the installed code, indicating potential data exfiltration or control by malicious actors.
IFF Assessment
The article details a new attack vector where AI coding agents inadvertently introduce untrusted code into corporate networks, posing a significant risk to data security and system integrity.
Defender Context
This highlights a critical emerging threat where AI tools, intended to improve development efficiency, can become vectors for introducing vulnerabilities. Defenders need to monitor network traffic for unexpected outbound connections and investigate the origins of code execution, especially when AI coding assistants are involved in development processes.