AI coding agents executed unowned packages after following misconfigured machine-readable docs

Researchers at an Israeli stealth startup scanned 6,214 live domains belonging to defense contractors, Fortune 500 companies, and Big Tech firms, identifying 8,265 llms.txt and llms-full.txt files—files designed to provide machine-readable summaries for AI agents.

Of these, 120 files on distinct sites referenced one or more unregistered code packages or domain names, including commands like 'pip install [redacted]' and 'npm install [redacted].'

To test the risk, the researchers registered unclaimed names and hosted packages that triggered callbacks when executed. Within an hour, a Fortune 500 company’s agent reached out; over time, the researchers recorded callbacks from several Fortune 500 companies and startups, with the beacon revealing parent processes spawned by coding agents from Anthropic, OpenAI’s Codex, and Nous Research’s Hermes.

The researchers also found an active exploitation on clerk.com, where an llms.txt file contained 'npx clerk-next-fix-auth-protection.' After the domain slot was claimed, a malicious package was hosted, though Clerk noted that only installations via @clerk/eslint-plugin without prior binary presence would have been vulnerable.

The core issue is that AI agents treat llms.txt files as authoritative documentation, executing install commands without verifying package ownership or domain registration, effectively collapsing the boundary between data and executable code.

The researchers emphasized that the trust model is broken: agents do not distinguish between user instructions and content retrieved from third-party sources, and existing security controls fail to flag these as risky because the activity resembles legitimate package manager usage.

They added that faulty entries in llms.txt files may have been manually created before the AI era or generated by AI systems that could not differentiate between legitimate and illegitimate instructions.