Security researchers at an Israeli startup identified a vulnerability affecting corporate networks through misconfigured llms.txt and llms-full.txt files—standardized machine-readable documentation that AI agents use to understand website content. The researchers scanned 6,214 domains belonging to defense contractors, Fortune 500 companies, and major technology firms, discovering 120 files across different sites that referenced code packages or domains that did not actually exist.
To demonstrate the severity of the vulnerability, the researchers registered several of the unclaimed package names and hosted proof-of-concept code designed to alert their servers when executed. Within an hour, a Fortune 500 company’s systems connected to their beacon. Additional connections followed from multiple Fortune 500 companies and startups. Analysis of the traffic revealed that AI coding agents from Anthropic’s Claude, OpenAI’s Codex, and Nous Research’s Hermes had been involved in the installations. The affected companies did not respond to requests for comment.
The vulnerability stems from how AI agents treat vendor documentation as authoritative without verification. When llms.txt files contain installation instructions for non-existent packages from registries like PyPI or npm, attackers can register those unclaimed package names and host malicious code. The researchers documented one active attack where malware was hosted under a claimed package name referenced in a legitimate website’s llms.txt file. At least one case involved the domain clerk.com, though the company resolved the issue after being notified.
The underlying problem reflects fundamental limitations in how large language models process information. These systems cannot reliably distinguish between legitimate user instructions and content retrieved from untrusted sources, a weakness exploited through prompt injection attacks. All content an AI agent reads becomes potential executable instructions without proper safeguards in place.
The 120 misconfigured files contained 227 total installation commands referencing non-existent packages or domains. The origin of these faulty entries remains unclear, though researchers noted some predate the AI era and may have been manually created by humans, while others potentially resulted from AI systems hallucinating or misidentifying legitimate versus illegitimate instructions.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI