Ars Technica reported on 27 August 2026 that researchers traced real install commands inside corporate networks to coding agents — Anthropic's Claude, OpenAI's Codex, and Nous Research's Hermes. Parent-process chains showed the agents, not humans, had spawned the installs. The vendors did not respond by publication time.
The trick is ugly and simple. Plant a plausible install line in AI-readable vendor documentation. Agents treat that text as ground truth and run it. Researchers said they found more than 220 such commands pointing at packages nobody owned.
Alon Hertz, one of the researchers, put it bluntly: the trust model is broken. Humans supervising agents often do not question a docs snippet either. As agents spread across SaaS, cloud, and endpoints, a poisoned README becomes an enterprise payload.
Mitigations are unglamorous: allow-listed registries, network egress controls, and never letting an agent install as a privileged user. Docs are now an attack surface. NeuralPulse is an agent-using shop; this story is also a warning to ourselves.