Researchers scanning corporate networks discovered that more than 100 domains contain misconfigured llms.txt and llms-full.txt files that direct AI agents to install code from non-existent packages and unregistered domains. These files serve as machine-readable site summaries similar to robots.txt conventions and are increasingly used to provide AI agents with information about website content and structure.
In testing the vulnerability, researchers registered unclaimed package names and hosted code that would phone home when executed. Within an hour, they received responses from a Fortune 500 company, with dozens more arriving over time from additional large enterprises and startups. The parent process chains revealed that AI coding agents, including Claude, Codex, and Hermes, had executed the installed packages. The researchers documented 227 install commands across 120 misconfigured files pointing to non-existent resources.
The core issue stems from AI agents treating vendor documentation as authoritative without verification. When llms.txt files reference non-existent PyPI or npm packages with installation instructions, malicious actors can register those package names and distribute harmful code. Similarly, references to unclaimed domain names create opportunities for attackers to register and control those sites. One documented case involved a malicious package registered at a slot referenced in a legitimate clerk.com file.
The vulnerability reflects a fundamental limitation in large language models: they cannot reliably distinguish between legitimate user instructions and content retrieved from untrusted third-party sources. This weakness, known as prompt injection, means that everything an AI agent reads becomes potential executable input. The researchers note that misconfigured entries may have originated from both human error and AI hallucination, with some entries predating the AI era and manually created by humans. The affected companies have not independently verified whether actual infections have occurred from this vulnerability.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI