Coding agents installed unclaimed packages from llms.txt

Researchers at a stealth startup in Israel found 120 corporate documentation files, each on a different website, pointing to code packages or domain names that nobody had registered. They claimed a handful of those names, published packages that called home when executed, and got their code running inside corporate networks, Ars Technica reports.

At a glance

• A few dozen companies, some of them Fortune 500s, ended up executing the researchers' proof-of-concept code, the first of them within an hour of the test packages being hosted.
• Those files are an emerging convention giving machine-readable summaries of a site's content and high-level structure, the AI equivalent of the robots.txt standard that tells search engines how to index a site.
• Documentation on more than 100 websites now references potentially dangerous executable content that many AI agents install automatically, and at least one misconfigured site is directing visitors, human or AI, to live malware.

Registering a name that somebody else's build process asks for is a long-running supply-chain trick. What appears new here is the delivery path: documentation written for humans and machines now feeds straight into an execution loop, with an agent resolving a reference and a package manager fetching it before anyone reviews the line. That likely leaves a whole file class outside the controls built around lockfiles and CI pipelines.

A Fortune 500 phone-home arrived within an hour

The researchers scanned 6,214 live domains belonging to defense contractors, Fortune 500 and Big Tech companies. Of the 8,265 llms.txt and llms-full.txt files they collected, many sites hosting both, 120, each on a different site, pointed to one or more code packages or domain names that nobody had registered.

To find out what an AI agent does with such a file, the researchers registered a handful of the unclaimed names and published packages that made any machine executing them reach out to a server under their control. The first callback arrived within an hour, from a Fortune 500 company.

A few dozen further callbacks followed over time, some from other Fortune 500 companies and others from startups. Their beacon also recorded the chain of parent processes that spawned each install, which is how the researchers identified what was doing the installing.

Install chains led back to Claude, Codex and Hermes

The chain the beacon recorded ultimately showed coding agents doing the work. Anthropic's Claude, OpenAI's Codex and Nous Research's Hermes were among the agents that read the references in the documentation files and installed the researchers' packages on machines inside corporate networks.

Beyond the names the researchers registered, documentation files on more than 100 websites reference potentially dangerous executable content that gets installed automatically when many AI agents visit. At least one misconfigured site is directing visitors, human or AI, to live malware.

The convention itself is recent. Sites publish llms.txt and llms-full.txt so that AI systems can pick up a summary of what the site contains and how it is organized, in the same way robots.txt tells crawlers what to index on a site.

Hertz says agents and their supervisors treat vendor docs as ground truth

The trust model is broken. Agents treat vendor docs as ground truth and don't question them.

Alon Hertz, one of the researchers, wrote that in an interview, adding that the humans supervising the agents do not question the documentation either. Agentic AI usage is exploding and agents are spreading across every layer, SaaS, cloud and endpoint, he said, and as they multiply the supply-chain surface grows while today's guards do not cover it.

Reference material for the convention exists. Google Lighthouse, a tool aimed at web developers, carries documentation on it, and Cloudflare publishes llms.txt and llms-full.txt files that Ars Technica cites as correctly configured examples of the format. Both are plain-text files served from the site itself.

The names still unclaimed The researchers registered only a handful of the unregistered packages and domains they found across the 120 files, and the rest were left untouched. Ars Technica does not name the companies whose machines executed the code, nor the startup behind the scan, which is in stealth. The report gives no timeline for fixing the misconfigured site that points visitors to live malware.