# When llms.txt names unregistered packages > Source: > Published: 2026-08-27 04:00:00+00:00 August 27, 2026 / touches [B](/build/) [S](/secure/) [R](/run/) # When llms.txt names unregistered packages A reported scan found 120 corporate llms.txt files that referenced unregistered packages or domains. The failure spans Build, Secure, and Run. Ars Technica reports that researchers scanned 6,214 corporate domains and found 8,265 `llms.txt` and `llms-full.txt` files. Files on 120 sites contained 227 commands that referenced unregistered packages or domains. The researchers claimed a few names and published packages that sent a beacon when executed. A Fortune 500 system called back within an hour, and later callbacks identified Claude, Codex, and Hermes in the parent process chain.[1](#fn:1) ## Failure mechanism The affected files were legitimate documentation. Some references predated current AI agents, and the package or domain names had never been registered or had lapsed. Claiming a name changed the destination of an existing instruction. Ars also reports that one vendor file referenced an npm name already occupied by live malware; the vendor later removed the reference.[1](#fn:1) Execution required an agent with shell access. The documentation supplied a command, the package registry resolved its target, and the agent ran the result. Endpoint detection could see an approved package manager contacting an approved registry under an approved coding tool, so those signals did not identify ownership of the package name. ## BROCS mapping **Build.** Documentation consumed by coding agents belongs in the software supply-chain review. Verify package and domain ownership, pin dependencies, and check generated machine-readable files before publication. The [Amazon Q incident](/resources/failure-modes/#amazon-q-wiper) shows the related risk when executable instructions ship inside an official artifact. **Secure.** Restrict the tools available to agents. A lockfile, package allowlist, or approval between download and execution can interrupt this path. The [agent controls](/secure/agents/) should apply to instructions retrieved from vendor and project documentation. **Run.** Apply outbound network policy to the agent runtime. An egress rule that rejects unapproved destinations can stop a callback even when package installation was allowed. The [runtime guidance](/run/runtime/) treats network reach as part of the workload boundary. ## Transitive trust An agent may read documentation from a supplier, partner, or community project. Each source can introduce a package name, domain, or command into the execution path. Review the full chain of references instead of limiting the check to files on the organization's own domain. brocs.fyi publishes [ llms.txt](/llms.txt) and [. They contain definitions and first-party links without install commands or package names. They still need review as input an agent may act on.](/llms-full.txt) `llms-full.txt` The incident is recorded in the [failure-mode library](/resources/failure-modes/#llmstxt-unowned). Teams can also check their own machine-readable documentation, verify the ownership of every executable reference, require approval before fetched code runs, and test whether the runtime blocks unapproved egress. Dan Goodin, ["Claude, Codex, and Hermes installed unowned code inside corporate networks"](https://arstechnica.com/security/2026/08/claude-codex-and-hermes-installed-unowned-code-inside-corporate-networks/),*Ars Technica*, August 27, 2026.[↩︎](#fnref:1)[↩︎](#fnref1:1) [All field notes](/post/). The [RSS feed](/index.xml)and updates list announce new notes.