AI Agents: llms.txt Files Triggered Corporate Executions

Researchers have identified 120 AI instruction files pointing to 227 commands related to unclaimed packages or domains. Agents like Claude, Codex, and Hermes have followed these instructions, even within Fortune 500 groups. One case on clerk.com led to an active malicious package via npx.

Defenses Did Not Alert to Instructions Seen as Legitimate

The researchers describe a situation where security controls on workstations did not detect any anomalies, as the installation appeared to come from authorized sources, with a coding agent expected as the parent process. The detection failure occurs between instruction and execution. For an agent, a file llms.txt served over HTTPS on the official domain and in a standardized format is authoritative. The agent does not check whether the package name actually belongs to the company or if a link points to an expired domain, and follows the instruction. This trust extends transitively to documents from partners, suppliers, or communities. According to the researchers, the boundary between data and code is collapsing, as demonstrated by the case where a command in a supplier's file seemed legitimate despite the absence of a reserved name in the registry.

Confirmed Executions, Including Within Fortune 500

After registering some unclaimed package names and hosting packages that forced a connection to their server upon execution, the researchers observed execution feedback. A Fortune 500 company responded in less than an hour, followed by several dozen other responses from other Fortune 500 groups and startups. Telemetry allowed tracing the chain of processes leading to the installation, involving coding agents such as Claude, Codex, and Hermes. These observations confirm that operational agents in companies have applied instructions from these files. Anthropic, OpenAI, and Nous Research had not responded to inquiries at the time of publication.

A Case of Active Malware Linked to npx on clerk.com

An instruction file hosted on the clerk.com domain contained the command npx clerk-next-fix-auth-protection. Since npx can execute a retrieved binary without adding it to the dependency manifest, the command exposed a direct vector. A third party then claimed the location and hosted an active malicious package there. Clerk rectified the situation and clarified that an agent that had already installed a binary included in @clerk/eslint-plugin was not at risk; otherwise, the malicious package would have been installed. There is no evidence confirming actual infections resulting from this episode.

The Mechanism: llms.txt Files and Unclaimed Dependencies

The llms.txt and llms-full.txt files, presented as the AI equivalent of robots.txt and referenced by development tools, serve summaries intended for agents. Compliant examples exist for environments like Cloudflare. Documented configuration errors list non-existent packages on PyPI, npm, and other registries, with installation directives. Attackers can then register these available names to place harmful payloads. The vulnerability manifests when authorized agents interpret these files as valid instructions and proceed to download and execute them. In other cases, the files refer to non-created domain names that a third party could register to publish unwanted instructions.

The Extent of the Phenomenon Documented by Researchers

Scanning 6,214 domains of industrial and technological actors identified 8,265 AI instruction files. Among them, 120 distinct files pointed to unclaimed packages or domains, totaling 227 associated commands. More broadly, similar documents on over 100 sites include references to potentially executable content that could automatically install for many agents. Companies, including those in the Fortune 500, have executed demonstration codes, and one case of a misconfigured site redirected visitors to active malware.

Possible Origins of Errors and Structural Vulnerability

The models used do not reliably distinguish between instructions entered by a user and directives found in third-party content, potentially executing the latter without dedicated safeguards. The researchers remind us that any input can be interpreted as an instruction, transforming a large corpus of data into an execution surface devoid of the guarantees applied to code. The precise origin of the problematic entries remains undetermined: some traces date back to content prior to the rise of AI, while others may result from automated generation that failed to distinguish between legitimate and improper directives. This weakness is related to prompt injections but extends beyond this framework. Alon Hertz emphasizes that initially legitimate instructions become dangerous when the associated references are abandoned and then reclaimed. The phenomenon is not limited to AI instruction files and is amplifying as large companies increasingly integrate these systems. He also believes that trust in documentation and the dissemination of agents on SaaS, cloud, and endpoints increases the attack surface.