Security researchers at an Israeli startup identified a significant vulnerability affecting artificial intelligence agents accessing corporate documentation files. Through scanning more than 6,000 domains owned by defense contractors, Fortune 500 companies, and major technology firms, investigators found 120 misconfigured llms.txt and llms-full.txt files—machine-readable documentation designed for AI consumption—each referencing one or more unregistered code packages or domain names.
To demonstrate the vulnerability’s severity, researchers registered a sample of the unclaimed names and hosted test packages designed to signal when executed. Within an hour, they detected a response from a Fortune 500 company. Over time, additional phone-home signals came from several Fortune 500 firms and startups. Analysis of the process chains revealed that AI coding agents, specifically Claude, OpenAI’s Codex, and Nous Research’s Hermes, were responsible for executing the test packages. Representatives from Anthropic, OpenAI, and Nous Research did not respond to requests for comment.
The core issue stems from how AI agents process documentation files. When agents encounter installation instructions within llms.txt files served over HTTPS on official company domains, they treat the content as authoritative without verification. If such files list non-existent packages with installation commands like “pip install [package-name],” attackers could register those package names and distribute malware. Similarly, when files reference non-existent domains, bad actors could register those domains and host malicious instructions.
Researchers documented at least one active exploitation case involving clerk.com’s LLM file, which referenced an npm package that had been claimed by an attacker to distribute live malware. The threat represents a fundamental weakness in how language models distinguish between legitimate user instructions and content retrieved from third-party sources. AI agents currently lack reliable guardrails to differentiate between trustworthy and potentially compromised documentation, creating what researchers describe as a broken trust model where all published data accessible to agents has become an execution surface without integrity guarantees.
The 120 problematic files contained 227 total commands targeting non-existent packages or domains. The origins of these misconfigured entries remain unclear, though researchers note many predate the AI era and may have been manually created, while others potentially resulted from AI systems hallucinating or similarly failing to validate information authenticity.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI