Series The Harness · 3 of 5
At the end of August, Alon Hertz published a research write-up with a title that should be printed on every CTO's coffee mug: Data Became Code. His team scanned 6,214 live corporate domains and found more than 8,000 llms.txt files, the plain-text instructions companies publish so AI agents can read their docs.
Some of those files told agents to install packages that did not exist. Nobody owned the names. So the researchers registered them, put a harmless beacon inside ("I was installed, here is when"), and waited.
The first callback came from a Fortune 500 company in under four minutes.
Dozens more followed. The agents named in the coverage: Claude, Codex and Hermes. Nobody typed a URL. The prompt was a single line asking the agent to build a project with a vendor's SDK. The agent found the llms.txt on its own and ran what it said.
(The exact count of dangling references depends on who is counting: Ars Technica reported 120 files, the researchers list 237 unclaimed packages and domains. Pick either number. Neither is comforting.)
This was not a hypothetical
The same trick had already been used for real. In July a package called clerk-next-fix-auth-protection appeared on npm, matching a bare command in an authentication vendor's docs. It is now catalogued as MAL-2026-11069 on OSV: at install time it sent the user name, machine name and working directory to an external server. Clerk fixed its docs. The pattern stays.
The agents did nothing stupid here. They did exactly what a diligent junior would do: read the official documentation, follow the install step. That is the whole problem. As Bruce Schneier put it in his note on the research, AI coding agents are not yet trustworthy. I would add: neither is the paper they read.
The cage has a price tag
This is where the series comes back in. In part two I argued that the harness, not the model, is the moat. Here is the part vendors mention less: the most valuable piece of the harness is the cage, and the cage costs money.
A paper posted on arXiv on 2 August, Permission Denied, measured it. The authors ran 12 model-harness bundles in hardened environments: a 205-domain network allowlist, read-only system folders, no sudo. Under the strictest policy, Claude Sonnet 5 lost 18.3 points of task success. Grok 4.5 kept its success rate but burned 167.3% more to get there.
So the cage makes agents slower, dumber or more expensive. Guess what teams do when a sprint is late. They turn it off. The community even has a name for it: "YOLO mode", every action auto-approved.
Anthropic reported last year that its sandbox cut permission prompts by 84%, adding that it only works with both filesystem and network isolation. One without the other is a locked door with no wall.
Otis sold the brake
In 1854, at the Crystal Palace exhibition in New York, Elisha Otis stood on a raised platform and had the rope cut. The platform dropped a few inches and stopped. "All safe, gentlemen, all safe." Elevators existed before Otis. What didn't exist was a reason to trust one with your body. Three years later the first passenger elevator went into a five-storey department store on Broadway, and cities started growing upward.
The motor was never the product. The brake was.
Coding agents are at the same moment. The model is the motor, and motors are converging. The harness that decides what the agent can reach (which domains, which registries, which folders, with whose credentials) is the brake. It is also the only piece that turns a demo into something you can put inside a bank.
Why this matters for your business
Two questions, one for each side of the fence.
If you use coding agents: can your agents install a package from a public registry without anyone seeing it? If the honest answer is "I don't know", you have a sandbox problem, not a model problem.
If you publish docs: your llms.txt is now an instruction surface. Every package name in it is a promise that you own that name. Most companies publishing these files have just become registry administrators without knowing it.
Part of The Harness, a series on the centrality of the harness in agentic AI. Previous: the model is the commodity, the harness is the moat.