AI Coding Agents Are Installing Untrusted Code: The 2026 Supply Chain Risk

On September 4, 2026, two security flags went up on the same day. Bruce Schneier published "AI Coding Agents Are Installing Unknown/Untrusted Code on Corporate Networks", summarizing research in which AI coding agents — Anthropic's Claude, OpenAI's Codex, and Nous Research's Hermes — installed unvetted code inside real corporate networks. The same day, Security Boulevard published "Supply Chain of Distrust", its analysis of the Microsoft/GitHub compromise that targeted AI developers, concluding that "AI coding environments are now privileged supply-chain systems, not just productivity tools."

Are AI coding agents safe?

The study: agents installing unvetted code on corporate networks

Researchers at a stealth startup in Israel scanned 6,214 live domains belonging to defense contractors, Fortune 500 companies, and Big Tech firms. They found 8,265 llms.txt and llms-full.txt files — machine-readable files, the "AI equivalent of the robots.txt standard," that tell agents what a site contains. Of those, 120 files, each on a different site, pointed to packages or domains that were not registered, and contained 227 commands to install non-existent packages or visit unclaimed domains.

To test what happens when an agent processes such files, the researchers registered some unclaimed names and hosted packages that made any machine executing them phone home to the researchers' server. Within an hour, a Fortune 500 company phoned home; a few dozen more followed, some from other Fortune 500s, others from startups. Ars Technica reported the story on August 27, 2026.

Their beacon also recorded the chain of parent processes that spawned each install — implicating Claude, OpenAI's Codex, and Nous Research's Hermes. Anthropic, OpenAI, and Nous did not respond to requests for comment. The mechanism is simple: a coding agent with shell access treats an llms.txt file as authoritative setup documentation and downloads and runs the package it names.

The researchers found an LLM file on the legitimate site clerk.com containing the text npx clerk-next-fix-auth-protection; npx executes a fetched package without adding it to a project manifest. The once-empty slot had already been claimed — and was hosting live malware. "An agent doesn't distinguish between a page and a command," the researchers wrote.

Schneier's warning: think SolarWinds-style supply chain attacks

Schneier's September 4 post opened, "We cannot forget that AI coding agents are not yet trustworthy," and warned: "This kind of thing will be exploited. Think Solar Winds–style supply chain attacks."

In SolarWinds, attackers compromised the trusted update path and every customer who trusted the vendor installed the backdoor. With coding agents, the trusted path is documentation, registries, and repositories the agent treats as ground truth. Researcher Alon Hertz: "The trust model is broken. Agents treat vendor docs as ground truth and don't question them—and neither do the humans supervising them." A vendor's documentation is benign the day it is written; the danger arrives when the package or domain it references is abandoned and someone else claims it.

Case study: the Microsoft/GitHub supply chain attack on AI developers

The incident behind the September 4 analysis happened months earlier. On June 5, 2026, the Miasma worm campaign reached Microsoft's Azure GitHub organizations. GitHub disabled 73 repositories across four Microsoft organizations — Azure, Azure-Samples, Microsoft, and MicrosoftDocs — in a 105-second automated sweep after a malicious commit hit Azure/durabletask using a previously compromised contributor account, per StepSecurity and The Hacker News. Microsoft said it had "temporarily removed some repositories" while investigating "potential malicious content."

What made this an AI-developer attack was delivery. The campaign planted configuration files that execute a credential-harvesting payload when a developer opens the repository in Claude Code, Gemini CLI, Cursor, or VS Code. StepSecurity: "The shift from 'execute on package install' to 'execute on folder open' is significant… A .claude/settings.json SessionStart hook is effectively a postinstall for your editor."

Security Boulevard's analysis explains the targeting: coding agents "read repositories… invoke terminals… touch secrets, environment variables, package-lock files, configuration files, build scripts, API clients, cloud SDKs, and deployment workflows." A malicious file where an agent reads it can be trusted, executed, or folded into the build. "It is not just malware in code. It is malware in the developer's decision loop."

The numbers behind the trend

The Phoenix Security Supply Chain Acceleration Report 2026 (June 8, 2026) counted 14 campaigns and 111 indexed packages for all of 2025, versus 37 campaigns and 497 indexed packages in H1 2026 alone — 2.6x the campaign volume and 4.5x the package volume of the entire preceding year. Its corpus also found AI agent tooling — MCP server injection, .cursorrules poisoning, CLAUDE.md hidden instructions, SessionStart hooks — was a confirmed delivery mechanism in at least 14 of 59 tracked campaigns.

The ghost-package research (arXiv:2605.17062), covered by Tech Bytes on July 5, 2026, found five frontier models — Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro, DeepSeek V3.2 — hallucinated the same 127 package names (109 PyPI, 18 npm) that exist in no registry; after coordinated disclosure, 53 remained registrable by an attacker. "The problem is not that the code fails to run; it is that the missing name is a blank slot anyone can fill."

Should I let Claude or Codex install packages automatically?

These are not hypothetical vendors: Claude Code, OpenAI's Codex, and Nous Research's Hermes appeared in the study's parent-process chain, and the Microsoft/GitHub incident targeted repositories opened in Claude Code, Gemini CLI, Cursor, and VS Code.

Practical controls: keep agents from installing untrusted code

NIST SP 800-218, the Secure Software Development Framework, calls for protecting all forms of code from tampering, securing the development environment, verifying third-party software, and maintaining provenance across the lifecycle. Applied to coding agents, that becomes seven controls:

1. No auto-install by coding agents. Default to "propose, don't install." Require a human to approve install and execution commands, and remove blanket shell access.
2. Package allow-listing. Keep an allow-list of registries, packages, and versions agents may fetch and block everything else — catching abandoned-package and ghost-package installs.
3. Network egress restrictions for agents. Run agents where they cannot reach production, secrets vaults, or internal services. The study worked because agent machines could phone home; Miasma harvested credentials because agent-connected environments could reach them.
4. Audit logs of agent-initiated installs. Record every command an agent runs: what was installed, from where, when, and under which identity. You cannot investigate what you did not log.
5. GitHub org secret rotation. After any supply-chain exposure, rotate org secrets, deploy keys, and tokens; revoke stale contributor accounts; assume repo contents — not just code — may be hostile.
6. GitHub Actions permission review. Keep Actions permissions narrow, no production secrets in reusable workflows, branch protection and signed commits, and scan workflow files, agent instruction files, editor config, and hidden project files.
7. Code provenance checks. Verify signed commits, source attestations, and checksum-verified dependencies, and inventory what agents may read and execute. Provenance turns "the agent installed it" from a mystery into a decision you made.

Security Boulevard's analysis adds the same controls from the incident side: short-lived credentials, least privilege for developer tokens, CI/CD isolation, no agent access to production secrets, and monitoring for unusual token use, package publication, and outbound connections.

Bottom line: this is a policy problem before it is a technical one

The code is no longer just code — the code is the credential. The strands you control are permissions: what agents may install, which registries and repos they trust, where they can send traffic, and what they touch when they run.

This extends the cluster we have been building all month: the same trust failure as LLMjacking, where leaked AWS keys burn your AI budget, and the same vendor-permission question in the AI agent risk checklist. If your team runs Claude, Codex, Cursor, Gemini CLI, or any agent that executes shell commands, add the seven controls above to your AI agent supply chain audit — then audit what your agents have already been allowed to install.

Run the free AI audit tool

Frequently asked questions