llms.txt files led coding agents to install unclaimed packages
Researchers say 120 sites hosted llms.txt files pointing to unregistered packages, and agents including Claude, Codex and Hermes installed them inside corporate networks.
Documentation files on more than 100 websites reference executable content that gets installed automatically when AI agents visit them, according to research reported by Ars Technica. Several dozen organisations, including Fortune 500 companies, ended up executing proof-of-concept code inside their own networks.
The content sits in llms.txt and llms-full.txt files, an emerging convention for giving AI systems machine-readable summaries of a site's structure and content. They are positioned as the AI equivalent of robots.txt.
227 faulty commands
Researchers at a stealth startup in Israel scanned 6,214 live domains belonging to defence contractors, Fortune 500 firms and Big Tech companies. Of the 8,265 files found, 120; each on a different site; pointed to code packages or domain names that were not registered, adding up to 227 faulty install or reference commands.
The team registered some of the unclaimed names and published packages that phoned home when executed. Within an hour they received a response from a Fortune 500 company, followed by a few dozen more over time. Parent-process chains showed that the installs came from coding agents including Claude, OpenAI's Codex and Nous Research's Hermes. Ars Technica said Anthropic, OpenAI and Nous Research did not respond to requests for comment before publication.
One live malware case
On the legitimate site clerk.com, the researchers found a file containing "npx clerk-next-fix-auth-protection". Someone had claimed the previously empty package name and used it to host live malware. Clerk has resolved the issue and noted that if an agent had already installed a binary included in the @clerk/eslint-plugin package, there was no threat. Whether any actual infections occurred is unclear.
"The trust model is broken," researcher Alon Hertz said. "Agents treat vendor docs as ground truth and don't question them; and neither do the humans supervising them."
Full details are in the Ars Technica report.
