Security researchers at an Israeli startup identified a significant vulnerability in how artificial intelligence agents interact with machine-readable configuration files on corporate websites. The researchers scanned thousands of domains belonging to defense contractors, Fortune 500 companies, and major technology firms, discovering misconfigured llms.txt and llms-full.txt files that reference non-existent code packages and domains.
These files serve as machine-readable summaries designed to help AI agents understand website content and structure, similar to how robots.txt guides search engine indexing. However, 120 files across different websites contained 227 commands pointing to unregistered packages or unclaimed domain names. To test the vulnerability, researchers registered some of these unclaimed names and hosted beacon code to track interactions. Within an hour, they received responses from a Fortune 500 company, eventually documenting communications from multiple major corporations running AI agents including Claude, OpenAI’s Codex, and Nous Research’s Hermes.
The core issue stems from how AI agents treat these configuration files as authoritative documentation without verifying the legitimacy of referenced packages or domains. When agents encounter installation instructions like “pip install [package-name],” they execute them without confirming the package actually exists or belongs to the company. This creates an attack surface where malicious actors can register unclaimed package names or domain names and host harmful code. At least one active attack was documented on clerk.com, where someone registered a malicious package that would have installed without adding itself to project dependencies.
The vulnerability reveals a fundamental limitation in large language models: they cannot reliably distinguish between legitimate user instructions and potentially malicious content encountered during web browsing. Security researchers noted that AI agents read all content as potential instructions, meaning the entire corpus of published data has effectively become an execution surface without integrity guarantees. The faulty entries likely originated from a combination of manual errors by human developers and hallucinations by AI systems, with some predating the current AI era.
Anthropology, OpenAI, and Nous Research did not respond to requests for comment. The discovery underscores growing concerns about supply-chain vulnerabilities as AI agents become increasingly deployed across enterprise infrastructure layers.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI