Ars Technica | 2026-08-27

Researchers at a stealth startup in Israel scanned 6,214 live domains belonging to defense contractors, Fortune 500, and Big Tech companies and found 8,265 llms.txt and llms-full.txt files; 120 of them, each on a different site, pointed to code packages or domain names that weren't registered anywhere. To test what happens when an AI agent processes such files, the researchers registered a handful of the unclaimed names and hosted packages that caused any machine executing them to reach out to their server. Within an hour they received a phone-home response from a Fortune 500 company; over time they got a few dozen more, from more Fortune 500 companies and startups. Their beacon also recorded the chain of parent processes that spawned each install, ultimately revealing that coding agents — including Anthropic's Claude, OpenAI's Codex, and Nous Research's Hermes — were involved. Anthropic, OpenAI, and Nous Research did not respond to requests for comment. The files are misconfigured because they list non-existent packages from PyPI, npm, and other registries with install instructions (e.g., "pip install [redacted]" or "npm install [redacted]"). Because the package names are unregistered, an attacker could register one and host ransomware or any other harmful package; the vulnerability occurs when a coding agent with permission to run shell commands treats the file as authoritative setup documentation and installs and runs the package. In other cases the llms files point to non-existent domain names that an attacker could later claim to plant malicious instructions. At least one active attack is already exploiting the mixup: the researchers found an llms file on the legitimate site clerk.com containing "npx clerk-next-fix-auth-protection" — and someone had claimed the once-empty slot and used it to host live malware. Unlike a conventional install, npx can fetch a package into npm's cache and execute its exposed binary without adding it to the project's dependency manifest. Clerk has since resolved the problem and said the malicious package would only install if an agent had not already pulled in the legitimate @clerk/eslint-plugin binary. "The trust model is broken," researcher Alon Hertz wrote. "Agents treat vendor docs as ground truth and don't question them — and neither do the humans supervising them. Agentic AI usage is exploding, and agents are spreading across every layer — SaaS, cloud, endpoint. As they multiply, so does the supply-chain surface, and today's guards don't cover it." The finding underscores LLMs' fundamental inability to reliably distinguish authentic user instructions from content in untrusted third-party sources — the root cause of prompt-injection-class attacks.

Read more