When llms.txt names unregistered packages

A scan of 6,214 corporate domains by researchers found 8,265 llms.txt and llms-full.txt files, with 120 sites containing 227 commands that referenced unregistered packages or domains, according to Ars Technica. Researchers claimed several names and published packages that sent a beacon when executed, and a Fortune 500 system called back within an hour, with later callbacks identifying Claude, Codex, and Hermes in the parent process chain. The findings highlight a supply-chain risk where AI coding agents can be tricked into installing unowned code from legitimate documentation.

August 27, 2026 / touches B /build/ S /secure/ R /run/ When llms.txt names unregistered packages A reported scan found 120 corporate llms.txt files that referenced unregistered packages or domains. The failure spans Build, Secure, and Run. Ars Technica reports that researchers scanned 6,214 corporate domains and found 8,265 llms.txt and llms-full.txt files. Files on 120 sites contained 227 commands that referenced unregistered packages or domains. The researchers claimed a few names and published packages that sent a beacon when executed. A Fortune 500 system called back within an hour, and later callbacks identified Claude, Codex, and Hermes in the parent process chain. 1 fn:1 Failure mechanism The affected files were legitimate documentation. Some references predated current AI agents, and the package or domain names had never been registered or had lapsed. Claiming a name changed the destination of an existing instruction. Ars also reports that one vendor file referenced an npm name already occupied by live malware; the vendor later removed the reference. 1 fn:1 Execution required an agent with shell access. The documentation supplied a command, the package registry resolved its target, and the agent ran the result. Endpoint detection could see an approved package manager contacting an approved registry under an approved coding tool, so those signals did not identify ownership of the package name. BROCS mapping Build. Documentation consumed by coding agents belongs in the software supply-chain review. Verify package and domain ownership, pin dependencies, and check generated machine-readable files before publication. The Amazon Q incident /resources/failure-modes/ amazon-q-wiper shows the related risk when executable instructions ship inside an official artifact. Secure. Restrict the tools available to agents. A lockfile, package allowlist, or approval between download and execution can interrupt this path. The agent controls /secure/agents/ should apply to instructions retrieved from vendor and project documentation. Run. Apply outbound network policy to the agent runtime. An egress rule that rejects unapproved destinations can stop a callback even when package installation was allowed. The runtime guidance /run/runtime/ treats network reach as part of the workload boundary. Transitive trust An agent may read documentation from a supplier, partner, or community project. Each source can introduce a package name, domain, or command into the execution path. Review the full chain of references instead of limiting the check to files on the organization's own domain. brocs.fyi publishes llms.txt /llms.txt and . They contain definitions and first-party links without install commands or package names. They still need review as input an agent may act on. /llms-full.txt llms-full.txt The incident is recorded in the failure-mode library /resources/failure-modes/ llmstxt-unowned . Teams can also check their own machine-readable documentation, verify the ownership of every executable reference, require approval before fetched code runs, and test whether the runtime blocks unapproved egress. Dan Goodin, "Claude, Codex, and Hermes installed unowned code inside corporate networks" https://arstechnica.com/security/2026/08/claude-codex-and-hermes-installed-unowned-code-inside-corporate-networks/ , Ars Technica , August 27, 2026. ↩︎ fnref:1 ↩︎ fnref1:1 All field notes /post/ . The RSS feed /index.xml and updates list announce new notes.