Claude installed unowned code from llms.txt files

Coding agents running inside corporate networks installed code packages that nobody had registered, after documentation files on more than 100 websites pointed them at unclaimed package names and domains. Ars Technica reported the findings of researchers at a stealth startup in Israel.

At a glance

• The files are llms.txt and llms-full.txt, machine-readable summaries of a site's content and structure that serve the same function for models that robots.txt serves for search crawlers.
• A scan of 6,214 live domains belonging to defense contractors, Fortune 500 and Big Tech companies turned up 8,265 such files, 120 of which pointed to unregistered code packages or domains.
• A few dozen companies, some of them Fortune 500s, executed the researchers' proof-of-concept code, and at least one misconfigured site is directing visitors, human or AI, to live malware.

The failure mode here is not a compromised registry or a typo-squatted dependency, it is documentation that agents treat as authoritative. That appears to move the supply-chain boundary from the package manager to whatever a vendor publishes for machines to read, a surface that few security teams currently inventory. Fortune 500 networks executing code from names registered by strangers suggests the human approval step is doing less filtering than it looks like it does.

Researchers scanned 6,214 live domains and pulled 8,265 llms.txt files

The researchers scanned 6,214 live domains belonging to defense contractors, Fortune 500 companies and Big Tech firms. They collected 8,265 llms.txt and llms-full.txt files, since many sites host both variants. On 120 of those sites, one file per site, the documentation pointed at one or more code packages or domain names that had never been registered.

llms.txt and llms-full.txt are an emerging convention for publishing machine-readable summaries of a site's content and its high-level structure, the AI counterpart to robots.txt. Google's Lighthouse documentation covers the format for web developers, and Cloudflare publishes both file types as reference examples of a correct configuration.

Across the scanned set, documentation on more than 100 websites referenced executable content that gets installed automatically when many AI agents visit, and at least one misconfigured site is sending anyone who follows it, human or AI, to live malware.

The first phone-home arrived from a Fortune 500 network within an hour

To find out what happens when an AI agent processes such a file, the researchers registered a handful of the unclaimed names they had found referenced in live documentation and hosted packages that make any machine executing them call back to a server under their control. The first response came within an hour, from a Fortune 500 company.

Over time a few dozen more callbacks arrived, some from other Fortune 500 companies and others from startups. Each beacon logged not only the network it came from but the full chain of parent processes that had spawned the install on the machine.

Parent-process chains identified Claude, Codex and Hermes

Those process chains showed which software had done the installing. Coding agents were on the list, including Claude, OpenAI's Codex and Nous Research's Hermes, running inside corporate environments where an agent had read a vendor's documentation and acted on it.

Alon Hertz, one of the researchers, wrote in an interview that the trust model is broken, describing agents as treating vendor docs as ground truth without questioning them, and the humans supervising those agents as doing the same. He said agentic AI usage is exploding and that agents are spreading across SaaS, cloud and endpoint layers, widening a supply-chain surface that today's guards do not cover.

Which unclaimed names remain open

The researchers registered only a handful of the unclaimed packages and domains referenced by the 120 sites, which leaves the rest available to anyone else who scans for them. The account does not say which site is routing visitors to live malware, whether the affected companies were told, or how many of the 120 documentation files have since been corrected.