Popular AI assistants secretly installed unknown code in companies

Three popular AI assistants — Claude, Codex, and Hermes — were found recommending that companies install 227 pieces of code that came from unknown, unverified sources. Think of these AI tools as digital assistants that help programmers write software faster. The problem: these assistants suggested code snippets without verifying who actually created or maintains them.

When a programmer uses these tools, they get suggestions for code that might speed up their work. But in this case, the AI systems pointed to code that had no clear owner — meaning nobody could be held responsible if something went wrong. It's like being told to install a piece of software from a stranger on the internet without any way to contact the creator if it causes problems.

This matters because companies store confidential information on their networks — financial data, customer details, trade secrets. If someone installs untrusted code, it could create a backdoor for hackers to sneak in and steal that information. Security teams typically have strict rules about what software can enter their networks for exactly this reason.

The research highlights a blind spot: as companies rely more on AI tools to speed up development, they may accidentally let potentially risky code slip past their defenses. It's a reminder that AI assistants, while helpful, still need human oversight before critical decisions are made.