Researchers have identified a vulnerability in how AI coding agents process documentation files, finding that executable code was installed inside corporate networks without authorization. The issue stems from llms.txt and llms-full.txt files—a convention websites use to provide machine-readable summaries for AI systems—that pointed to unregistered code packages.
What Happened
Researchers at a stealth startup in Israel scanned 6,214 live domains belonging to defense contractors, Fortune 500 companies, and Big Tech firms. Of the 8,265 llms.txt and llms-full.txt files they discovered across these sites, 120 of them—each on a different domain—pointed to code packages or domain names that were not registered. To test what happens when an AI agent processes such files, the researchers registered some unclaimed names and hosted packages that contacted their server when executed. Within an hour, they received a phone-home response from a Fortune 500 company. Over time, they collected responses from dozens of companies, including additional Fortune 500 firms and startups. The beacon recorded that coding agents including Claude (Anthropic), OpenAI's Codex, and Nous Research's Hermes were among those executing the unverified code. At least one misconfigured site was directing visitors to live malware. Anthropic, OpenAI, and Nous Research did not respond to requests for comment.
Why It Matters
This research exposes a supply-chain risk emerging from an AI-specific web standard that has no security vetting mechanism. llms.txt files are designed to be consumed automatically by AI agents, similar to how robots.txt guides search engine crawlers, but they lack safeguards against malicious or unverified code references. Corporate networks running AI coding assistants could silently install and execute arbitrary packages without developer awareness. The fact that multiple Fortune 500 companies were affected suggests the issue is systemic rather than isolated.
The Bottom Line
The Israeli researchers demonstrated that current llms.txt conventions allow any website to trigger automatic code installation through AI agents, with no verification layer in place. Organizations deploying coding assistants may need to add guardrails around how these tools consume documentation files until a security standard emerges.