Claude, Codex, and Hermes installed 227 unowned code packages inside corporate networks
Summarized by AI from reporting by Ars Technica AI, published under our editorial policy.
Security researchers at Intezer found 227 instances where AI coding assistants Claude, Codex, and Hermes generated install commands pointing to code no one owns. The discovery reveals a systemic supply-chain risk in AI-assisted development.
Key takeaways
- Intezer researchers found 227 instances where Claude, Codex, and Hermes generated install commands pointing to unowned or abandoned code repositories.
- Unowned packages can be hijacked by attackers, creating a supply-chain vulnerability in AI-assisted development.
- Organizations should enforce mandatory code review for any AI-generated install commands and use dependency scanners to flag unmaintained sources.
Security firm Intezer analyzed corporate documentation and discovered that three popular AI coding assistants — Claude, Codex, and Hermes — had generated 227 installation commands that pointed to code repositories nobody owns or maintains. The finding exposes a new class of supply-chain vulnerability in AI-assisted software development.
AI coding assistants generated 227 install commands to unowned repositories
Intezer researchers examined internal corporate documents and codebases where developers had used AI assistants to generate code. They found that Claude (by Anthropic), Codex (by GitHub/Microsoft), and Hermes (by Meta) each produced commands that would install software packages from sources that were either abandoned, unmaintained, or never formally owned by any identifiable entity. In some cases, the AI tools hallucinated package names that did not exist at the time of generation but could be created later by a malicious actor.
The risk: unowned packages can be hijacked by attackers
The core danger is that an unowned repository can be claimed by anyone. If a developer runs an AI-suggested install command pointing to an abandoned package, an attacker could later upload a malicious version to the same location. The researchers confirmed that some of the 227 commands were executed inside corporate networks before the issue was caught, though they did not disclose which companies were affected.
Why this matters beyond the developer community
This is not just a developer problem. Any organization that uses AI coding tools to automate tasks — from internal scripts to customer-facing applications — inherits the risk of running unverified third-party code. For everyday users, the lesson is the same as with any software: never run installation commands without knowing exactly what they install and who maintains it.
How to protect against AI-generated supply-chain attacks
If your team uses Claude, Codex, Hermes, or any AI coding assistant, enforce a mandatory code-review step for every AI-generated snippet that contains an install, download, or curl command. Use package-scanner tools such as Snyk, SonarQube, or Dependabot to flag dependencies from unowned or unmaintained sources. Treat AI-generated code as you would code from an unknown contributor — verify before trusting.
Frequently asked
- How did the researchers find these 227 install commands?
- Intezer analyzed corporate documents and codebases where developers had used Claude, Codex, and Hermes, and identified installation commands that pointed to repositories with no identifiable owner.
- Were any of these commands actually executed inside corporate networks?
- Yes, the researchers confirmed that some of the 227 commands were executed before the issue was caught, though they did not name the affected companies.
- Can an attacker exploit an unowned package after it has been installed?
- Yes. If the package repository is abandoned, an attacker can claim it and upload a malicious version. Any system that installed the original package could then receive the malicious update.