Security researchers at an Israeli startup identified a significant vulnerability affecting corporate networks through misconfigured llms.txt and llms-full.txt files—machine-readable documents designed to guide AI agents. The files, which serve as the AI equivalent of robots.txt standards, are hosted on websites belonging to defense contractors, Fortune 500 companies, and technology firms.
During a scan of over 6,200 domains, researchers found 120 files across different sites containing references to unregistered code packages and unclaimed domain names. To test the potential impact, the researchers registered several of these unowned names and hosted beacon code that would signal when executed. Within an hour, they received responses from a Fortune 500 company, and over time collected dozens more from various enterprises. Analysis of the execution chains revealed that multiple AI coding agents—including Anthropic’s Claude, OpenAI’s Codex, and Nous Research’s Hermes—were downloading and running the test code.
The vulnerability stems from how AI agents treat these files as authoritative documentation without verification. When llms.txt files contain installation instructions for non-existent packages on registries like PyPI and npm, attackers can register the unclaimed package names and distribute malware. The researchers documented at least one active exploitation case involving a legitimate website where malware was hosted under a previously unclaimed package name.
The core issue reflects a fundamental limitation of large language models: they cannot reliably distinguish between legitimate user instructions and untrusted content encountered during web browsing. Every piece of information an AI agent reads is treated as potential instruction, transforming published data across the internet into an unverified execution surface. The researchers noted that while some of these faulty entries may have originated from manual human error, others may have been generated by AI systems unable to distinguish legitimate from illegitimate instructions.
Anthropologic, OpenAI, and Nous Research did not respond to requests for comment by the time of publication. One affected company, Clerk, resolved its issue after being notified of the problem.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI