Skip to main content

Claude, Codex, and Hermes Installed Unowned Code Inside Corporate Networks

1 week 3 days ago
An anonymous reader quotes a report from Ars Technica: Documentation files on more than 100 websites are referencing potentially dangerous executable content that gets installed automatically when visited by many AI agents [including Claude, OpenAI's Codex, and Nous Research's Hermes]. A few dozen companies, some of them Fortune 500s, are among those that executed proof-of-concept code. At least one misconfigured site is directing visitors, human or AI, to live malware. The potentially dangerous content is in llms.txt and llms-full.txt files, an emerging convention websites employ to provide machine-readable summaries of the site's content and its high-level structure. These files are the AI equivalent of the robots.txt standard that instructs search engines how to index the site's content. Google Lighthouse, a tool for helping web developers, has more here. Correctly configured llms.txt and llms-full.txt files for Cloudflare are here and here. "The trust model is broken," Alon Hertz, one of the researchers, wrote in an interview. "Agents treat vendor docs as ground truth and don't question them -- and neither do the humans supervising them. Agentic AI usage is exploding, and agents are spreading across every layer -- SaaS, cloud, endpoint. As they multiply, so does the supply-chain surface, and today's guards don't cover it." "An agent doesn't distinguish between a page and a command," the researchers wrote Thursday. "Everything it reads is input, and every input is a potential instruction. Which means the entire corpus of published data that agents are now wired to consume has silently become an execution surface -- and almost none of it carries the integrity guarantees we apply to actual code."

Read more of this story at Slashdot.

BeauHD

Trump Declares National Emergency to Ban Some Foreign Grid Equipment

1 week 3 days ago
Longtime Slashdot reader dhartshorn writes: Foreign-produced "bulk power" equipment is now effectively banned, and the list of what constitutes such equipment is essentially everything used to make up the grid... much of which we are heavily dependent on foreign sources to supply. In a Wednesday executive order, President Trump said foreign supply of electric equipment "constitutes an unusual and extraordinary threat" to national security. The Hill reports: Under the order, it will be up to Energy Secretary Chris Wright, in coordination with other officials, to determine whether a piece of equipment poses an issue. The order could impact a wide range of equipment, including substations, transformers, batteries used for energy storage, generators, turbines, software and more. It does not lay out specific threats or single out any country by name. [...] Under the last Trump administration, the president put a similar order in place. The new order comes amid several reported cyberattacks on U.S. water systems, which officials suspect have links to Iran, according to The New York Times.

Read more of this story at Slashdot.

BeauHD

Panic Passes Trump Tariff Refunds Back to Playdate Customers

1 week 3 days ago
Panic is refunding Playdate customers the 19% tariff charges it passed along while the Trump administration's import duties were in effect, after the Supreme Court ruled the tariffs illegal and the company began receiving refunds from the government. Panic says the money "just [wasn't] ours to keep." Ars Technica reports: In an update posted on the Playdate help site this week, Panic noted that it has finally "begun to receive refunds of the tariffs we paid in the last year" and had consequently "refunded all tariffs charged to customers." In the initial version of that tariff note, Panic explained that it couldn't afford to simply "absorb" the 19 percent tariffs it was being charged to import Playdate hardware made overseas because "our margins on Playdate are low." As such, while the tax was in effect, it was passed along to customers as an explicit subtotal line item at the bottom of all Playdate orders. That's in contrast to companies like Nintendo, which vaguely cited "market conditions" and tariff "uncertainty" in raising the asking price of legacy hardware and some Switch 2 accessories last year. Speaking to Game Developer, Panic co-founder Cabel Sasser said filing paperwork to claw back these taxes and processing tariff refunds for customers took a fair bit of backend work. Still, he said returning that money to Playdate purchasers in the end was a no-brainer. "It's just not our money to keep, and it felt really good to give it back," Sasser said. "That's an easy way to know you made the right decision." "It just felt like the right thing to do," Panic wrote in a refund email message shared on Reddit.

Read more of this story at Slashdot.

BeauHD