27 August 2026
Researchers find AI coding agents vulnerable to malicious packages via misconfigured instruction files
First reported
Ars Technica, Sloth Bytes and 1 other ran this on , all on the same day.
- Websites publish llms.txt and llms-full.txt files (machine-readable instruction guides for AI) that sometimes reference non-existent software packages or domains that attackers can claim.
- Researchers scanned 6,214 company websites and found 120 files with 227 commands pointing to unclaimed packages. They registered some names and received responses from Fortune 500 companies within hours.
- Coding agents including Claude, Codex, and Hermes treated these official-looking instruction files as trustworthy and attempted to install malicious packages without questioning whether the packages actually existed.
- At least one live attack used this method on Clerk.com, where a malicious package was hosted under an unclaimed name listed in the company's own instruction file.
Where they differ
Sloth Bytesreported on Claude's compatibility with agents.md standards and a Shopify CEO's criticism.
The Neurondiscussed Claude's new browser capability. Neither newsletter covered the actual security research about malicious packages in instruction files, which is the substantive story across all outlets.
What each one reported
Tobi Lütke tweeted that Shopify is considering banning Claude Code because it does not support the agents.md standard that Codex, Cursor, and Copilot already support, creating what he calls a split-brain problem. Anthropic responded saying Claude Code will soon support this standard.
Claude now includes a built-in browser allowing it to open websites, click elements, type text, and fill out forms directly in a side panel while users observe the actions.
Reported by Ars Technica