AI Agents Install Unowned Code From 120 Misconfigured llms.txt Files
Updated
Updated · Ars Technica · Aug 27
AI Agents Install Unowned Code From 120 Misconfigured llms.txt Files
1 articles · Updated · Ars Technica · Aug 27
Summary
Researchers found Claude, OpenAI’s Codex and Nous Research’s Hermes automatically installed proof-of-concept packages after visiting websites whose llms.txt files pointed to unregistered code locations.
A scan of 6,214 live domains uncovered 8,265 llms.txt and llms-full.txt files, including 120 on separate sites that referenced one or more unowned packages or domains.
After registering some of those names and hosting beaconing packages, the researchers got a callback from a Fortune 500 company within an hour and later from a few dozen more companies.
At least one misconfigured site pointed visitors—human or AI—to live malware, extending the risk beyond the proof-of-concept installs.
The findings highlight a new supply-chain weakness in the emerging llms.txt standard, which websites use as an AI-facing counterpart to robots.txt.
What happens when autonomous AI blindly trusts abandoned website links to execute code inside secure corporate networks?
How could a simple text file meant to guide AI secretly turn your company's automated agents into a hacker's puppet?
How 120 Misconfigured `llms.txt` Files Exposed Fortune 500 Companies to AI Supply Chain Attacks
Overview
Researchers discovered that misconfigured `llms.txt` files on major company websites pointed to unregistered domains, allowing attackers to hijack automated AI processes. By registering these domains, the researchers showed that coding agents like Claude and Codex would blindly execute external code, exposing sensitive systems. This risk is amplified because AI agents treat documentation as trusted instructions and can be tricked into running malicious code or leaking secrets, especially when attackers register domains that AI models hallucinate. Traditional security tools cannot detect these attacks, highlighting the urgent need for stronger runtime governance and secure frameworks for AI agent operations.