Nintendo's latest sale is 'made possible' by the tariff refunds it's hoarding15m ago Instagram now lets you add tagged photos to your profile grid16m ago Sure, Meta’s AI Muse works, but it sure creeps me out16m ago AI agents are flooding public services with new requests23m ago The iPhone Duo just might live up to the hype23m ago People are flooding X with joke resignation announcements imitating the viral AI extinction warning25m ago Anthropic Is Building a Huge Surveillance System to Spy on Anti-AI Activists and Predict Their Activities33m ago Antioch raises $32m to test robots in simulation before they touch hardware41m ago OpenAI’s Bubeck denies trying to cut Anthropic mathematician from credit56m ago 10 of the scariest AI villains in movie history57m ago Maven Robotics wants to steal your robot deployment deal59m ago Agent Security Is Not AI Governance: Why Conflating The Two Is A Risk Enterprises Can't Afford1h ago Positron Valued at $5 Billion in New Funding as Demand for AI Chips Surges1h ago 7 Steps to Become a Forward Deployed Engineer in 20261h ago

Nintendo's latest sale is 'made possible' by the tariff refunds it's hoarding15m ago Instagram now lets you add tagged photos to your profile grid16m ago Sure, Meta’s AI Muse works, but it sure creeps me out16m ago AI agents are flooding public services with new requests23m ago The iPhone Duo just might live up to the hype23m ago People are flooding X with joke resignation announcements imitating the viral AI extinction warning25m ago Anthropic Is Building a Huge Surveillance System to Spy on Anti-AI Activists and Predict Their Activities33m ago Antioch raises $32m to test robots in simulation before they touch hardware41m ago OpenAI’s Bubeck denies trying to cut Anthropic mathematician from credit56m ago 10 of the scariest AI villains in movie history57m ago Maven Robotics wants to steal your robot deployment deal59m ago Agent Security Is Not AI Governance: Why Conflating The Two Is A Risk Enterprises Can't Afford1h ago Positron Valued at $5 Billion in New Funding as Demand for AI Chips Surges1h ago 7 Steps to Become a Forward Deployed Engineer in 20261h ago

Cybersecurity Dev3 min reading time

AI coding agents followed abandoned package references, 6K domains analyzed

Hacker NewsPublished 11 days ago

Researchers analyzed over 6,000 domains and found 120 unclaimed package or domain references in llms.txt files used by AI coding agents. These stale references could allow attackers to register the names and deploy malicious packages, potentially compromising corporate systems. An experiment showed that Fortune 500 companies' systems contacted these malicious packages within an hour, highlighting a new software supply-chain attack vector.

#ai-coding-agents #claude #fortune-500 #hermes #nous-research #openai-codex #package-management #software-supply-chain

More in Cybersecurity

Scoop: OpenAI faces GOP-led Senate investigation into Hugging Face breach

Covered by 2 sources6h ago

Cybersecurity6 min read

Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6

Covered by 2 sources8h ago

Cybersecurity5 min read

Every AI Incident Has Two Timelines. We Default To One

Forbes4h ago