Security researchers at an Israeli startup discovered a widespread vulnerability affecting more than 100 corporate websites, including those operated by Fortune 500 companies and defense contractors. The researchers identified 120 misconfigured llms.txt and llms-full.txt files—machine-readable documents designed to guide AI agents through website content—that referenced non-existent code packages or unregistered domain names. These files contained 227 installation commands pointing to packages that do not exist in standard code registries like PyPI and npm.
To demonstrate the severity of the issue, the researchers registered several of the unclaimed package names and hosted test code designed to send notifications back to their servers when executed. Within an hour, they received responses indicating that AI agents had attempted to install the malicious packages. Over time, the researchers documented installations from multiple Fortune 500 companies and startups. Their analysis revealed that coding agents from major AI companies, including Claude, OpenAI’s Codex, and Nous Research’s Hermes, were involved in the execution of the test code. Anthropic, OpenAI, and Nous Research did not provide responses to inquiries about the findings.
The vulnerability arises because AI agents treat configuration files hosted on official company domains as authoritative sources and do not verify whether referenced packages actually exist or are legitimate. When an agent encounters an installation command in these files, it proceeds to download and execute the code without validating the package identity or ownership. In at least one documented case, an attacker had already registered an unclaimed package name referenced in a configuration file hosted on clerk.com and used it to distribute live malware. The company subsequently addressed the issue.
Researchers noted that the fundamental problem reflects a broader limitation in how language models and AI agents process information. These systems cannot reliably distinguish between legitimate instructions entered directly by users and potentially malicious content encountered on untrusted third-party sources. The misconfigured entries appear to have originated through multiple pathways, including manual creation by humans and generation by AI systems that either hallucinated package names or failed to verify their authenticity. This vulnerability exposes the entire corpus of published data that AI agents access as a potential execution surface lacking the integrity protections typically applied to official code.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI