Security • 3 min read
Researchers found 120 unclaimed package or domain references across corporate llms.txt files. AI agents could use them to install malware.
Image: TechRadar AI coding agents can turn stale documentation into a software supply-chain attack. Researchers examining documentation intended for AI readers found 120 references to unclaimed code packages or domains across websites operated by defense contractors, Fortune 500 companies, and major technology firms.
The problem centers on llms.txt
and llms-full.txt
, conventions that provide AI systems with a machine-readable version of a website’s content. An agent looking for installation instructions or code dependencies can search those files, then act on commands and package names found in them.
The researchers analyzed 6,214 live domains and located 8,265 llms.txt
or llms-full.txt
files. The 120 problematic files were hosted on different sites and pointed to one or more package names or domain names that were not registered at the time of the study.
Those references may have come from human mistakes, copy-and-paste errors, renamed packages, abandoned projects, or hallucinated documentation. The security risk is that an attacker can register one of the abandoned names and publish a malicious package at the location an AI agent has been told to use.
How the attack chain works #
For the experiment, the researchers registered some of the unclaimed names and uploaded packages designed to phone home when installed. It took less than an hour for a Fortune 500 company to begin making contact with one of those packages. The number of organizations contacting the packages then grew to “a few dozen more.” Recommended reading
Equifax automates half of its security tickets with AI
Sophia Reynolds • • 6 min read
“a few dozen more”
That result demonstrates reachability, not a confirmed criminal campaign. The researchers' packages were deliberately created for the experiment, and the supplied findings do not establish that any company was infected or that production data was stolen.
The dangerous version of the chain is straightforward: an agent reads a stale or incorrect instruction, has permission to run shell commands or package-manager commands, and installs software from a name that an attacker has claimed. The agent does not need to identify the malicious package as suspicious if the documentation presents it as a legitimate dependency.
The researchers said Claude, OpenAI Codex, and Nous Research’s Hermes all executed or followed the problematic references during testing. That makes the issue broader than a defect in one vendor’s model. The common failure is unmaintained documentation combined with an agent allowed to treat documentation as an executable runbook.
Documentation cleanup is the immediate fix #
Organizations publishing llms.txt
files need to audit every package, command, and domain they reference. A dependency that was merely mistyped in documentation can become claimable infrastructure, while a package that was renamed or abandoned can remain an attractive target indefinitely.
The stronger control is to prevent agents from executing documentation instructions automatically. An agent could use the files as reference material while requiring an explicit approval step before running a shell command or installing a dependency. The source material does not establish whether the tested agents had such approval controls enabled, so it does not show how the results change under a restricted configuration.
The researchers' two recommended fixes address different parts of the chain: clean up broken references to remove attacker-claimable names, and restrict agent permissions so a bad reference cannot immediately become code execution. The first is an ordinary documentation-maintenance task; the second changes the trust model for AI-assisted development.
Frequently asked questions #
What is the llms.txt security problem?+ #
Some llms.txt and llms-full.txt files point to unregistered packages or domains. An attacker could claim those names and serve malware if an AI agent follows the documentation and installs the dependency.
Which AI coding agents were affected?+ #
The researchers said Claude, OpenAI Codex, and Nous Research’s Hermes were all affected during testing.
Did the researchers confirm malware infections?+ #
The supplied findings confirm that experimental packages received callbacks from a Fortune 500 company and a few dozen more organizations. They do not establish that production systems were infected or that data was stolen.
Sophia Reynolds Security Editor
Sophia unpacks the invisible wars happening on our networks. Covering cybersecurity, privacy legislation, and cryptography, she exposes how our data is weaponized and defended. Before joining for(geeks), she spent years as a penetration tester. She's the reason the rest of the team uses physical security keys.