Claude, Codex, and Hermes installed unowned code inside corporate networks
227 install commands were found in corporate docs pointing at code nobody owns.
Opening of the original on Ars Technica AI
Summary
Anthropic's Claude AI, along with other models like Codex and Hermes, inadvertently installed unowned code within corporate networks. Researchers discovered 227 install commands in company documents that pointed to code not managed by any specific entity. This situation raises significant security concerns regarding software supply chain integrity and the potential for unauthorized code execution within sensitive business environments.
Why it matters
Why it matters: This incident highlights a previously unknown vulnerability in how AI models might interact with corporate systems. When AI tools reference external code, especially code without clear ownership, it creates a supply chain risk. If this unowned code were malicious, it could be executed within a company's network. This affects any enterprise using AI assistants for coding or documentation. Competitors like Google Gemini and Microsoft Copilot also integrate with developer workflows, making them susceptible if similar issues arise. Future monitoring should focus on AI's code execution permissions and the provenance of code it references.
Related: OpenAI: Introducing GPT-6 Astra: the most intelligent and aligned model in the world. · Google: Proactive cyber defense for governments and enterprises · Microsoft: Claude Fable 5.1 is generally available in GitHub Copilot · Meta: Get the full story behind the light · xAI: OpenAI Cut Off a Billion-Dollar Customer to Avoid Elon Musk
Rated middle: a real update, not a headline event.
- OpenAI cuts out SpaceX-owned CursorThe Rundown AI · Web · Aug 31, 2026
- OpenAI cuts out SpaceX-owned CursorThe Rundown AI · Web · Aug 31, 2026
- ChatGPT, Grok, and Claude all went down at the same timeThe Verge AI · Web · Sep 3, 2026
- ChatGPT, Grok, and Claude all went down at the same timeThe Verge AI · Web · Sep 3, 2026
- Anthropic changes data retention policy after pushback from customersCNBC Technology · Web · Sep 1, 2026
- Anthropic Executive Doesn’t Want to ‘Buy Market Share’ With Price CutsBloomberg Technology · Web · Sep 3, 2026
- I Built a FREE App That Runs Your Entire BusinessMatt Wolfe
- Introducing Claude Fable 5Anthropic on YouTube
- Claude Mythos: Highlights from 244-page ReleaseAI Explained
Questions people ask
- What was discovered in corporate networks?
- Researchers found 227 install commands within corporate documents. These commands pointed to code that nobody officially owns or manages.
- Which AI models were involved?
- The AI models identified in relation to these commands include Anthropic's Claude, Codex, and Hermes.
More from Ars Technica AI 4 more
Page generated Sep 3, 2026. Summaries are Subvolts' own; the story belongs to Ars Technica AI.