{"slug": "when-llms-txt-names-unregistered-packages", "title": "When llms.txt names unregistered packages", "summary": "A scan of 6,214 corporate domains by researchers found 8,265 llms.txt and llms-full.txt files, with 120 sites containing 227 commands that referenced unregistered packages or domains, according to Ars Technica. Researchers claimed several names and published packages that sent a beacon when executed, and a Fortune 500 system called back within an hour, with later callbacks identifying Claude, Codex, and Hermes in the parent process chain. The findings highlight a supply-chain risk where AI coding agents can be tricked into installing unowned code from legitimate documentation.", "body_md": "August 27, 2026 / touches [B](/build/) [S](/secure/) [R](/run/)\n\n# When llms.txt names unregistered packages\n\nA reported scan found 120 corporate llms.txt files that referenced unregistered packages or domains. The failure spans Build, Secure, and Run.\n\nArs Technica reports that researchers scanned 6,214 corporate domains and found 8,265\n`llms.txt`\n\nand `llms-full.txt`\n\nfiles. Files on 120 sites contained 227 commands that\nreferenced unregistered packages or domains. The researchers claimed a few names and\npublished packages that sent a beacon when executed. A Fortune 500 system called back\nwithin an hour, and later callbacks identified Claude, Codex, and Hermes in the parent\nprocess chain.[1](#fn:1)\n\n## Failure mechanism\n\nThe affected files were legitimate documentation. Some references predated current AI\nagents, and the package or domain names had never been registered or had lapsed. Claiming\na name changed the destination of an existing instruction. Ars also reports that one\nvendor file referenced an npm name already occupied by live malware; the vendor later\nremoved the reference.[1](#fn:1)\n\nExecution required an agent with shell access. The documentation supplied a command, the package registry resolved its target, and the agent ran the result. Endpoint detection could see an approved package manager contacting an approved registry under an approved coding tool, so those signals did not identify ownership of the package name.\n\n## BROCS mapping\n\n**Build.** Documentation consumed by coding agents belongs in the software supply-chain\nreview. Verify package and domain ownership, pin dependencies, and check generated\nmachine-readable files before publication. The [Amazon Q incident](/resources/failure-modes/#amazon-q-wiper)\nshows the related risk when executable instructions ship inside an official artifact.\n\n**Secure.** Restrict the tools available to agents. A lockfile, package allowlist, or\napproval between download and execution can interrupt this path. The\n[agent controls](/secure/agents/) should apply to instructions retrieved from vendor and\nproject documentation.\n\n**Run.** Apply outbound network policy to the agent runtime. An egress rule that rejects\nunapproved destinations can stop a callback even when package installation was allowed.\nThe [runtime guidance](/run/runtime/) treats network reach as part of the workload\nboundary.\n\n## Transitive trust\n\nAn agent may read documentation from a supplier, partner, or community project. Each source can introduce a package name, domain, or command into the execution path. Review the full chain of references instead of limiting the check to files on the organization's own domain.\n\nbrocs.fyi publishes [ llms.txt](/llms.txt) and\n\n[. They contain definitions and first-party links without install commands or package names. They still need review as input an agent may act on.](/llms-full.txt)\n\n`llms-full.txt`\n\nThe incident is recorded in the\n[failure-mode library](/resources/failure-modes/#llmstxt-unowned). Teams can also check\ntheir own machine-readable documentation, verify the ownership of every executable\nreference, require approval before fetched code runs, and test whether the runtime\nblocks unapproved egress.\n\nDan Goodin,\n\n[\"Claude, Codex, and Hermes installed unowned code inside corporate networks\"](https://arstechnica.com/security/2026/08/claude-codex-and-hermes-installed-unowned-code-inside-corporate-networks/),*Ars Technica*, August 27, 2026.[↩︎](#fnref:1)[↩︎](#fnref1:1)\n\n[All field notes](/post/). The\n\n[RSS feed](/index.xml)and updates list announce new notes.", "url": "https://wpnews.pro/news/when-llms-txt-names-unregistered-packages", "canonical_source": "https://brocs.fyi/post/llms-txt-execution-surface/", "published_at": "2026-08-27 04:00:00+00:00", "updated_at": "2026-08-30 16:22:23.042322+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-tools", "ai-policy"], "entities": ["Ars Technica", "Claude", "Codex", "Hermes", "Amazon Q", "brocs.fyi", "Dan Goodin"], "alternates": {"html": "https://wpnews.pro/news/when-llms-txt-names-unregistered-packages", "markdown": "https://wpnews.pro/news/when-llms-txt-names-unregistered-packages.md", "text": "https://wpnews.pro/news/when-llms-txt-names-unregistered-packages.txt", "jsonld": "https://wpnews.pro/news/when-llms-txt-names-unregistered-packages.jsonld"}}