Overview
Researchers at an Israeli stealth startup have uncovered a novel AI agent supply chain attack vector exploiting llms.txt and llms-full.txt files — the emerging machine-readable documentation standard analogous to robots.txt. By scanning 6,214 corporate domains, they identified 120 sites whose llms.txt files referenced unregistered package names on PyPI, npm, and other registries. Registering a subset of those names and hosting beacon payloads, the team confirmed that AI coding agents — including Anthropic’s Claude, OpenAI’s Codex, and Nous Research’s Hermes — automatically executed the packages inside live corporate networks, with Fortune 500 firms among the victims.
Technical Analysis
The attack chain is straightforward but consequential. A misconfigured llms.txt or llms-full.txt file contains installation instructions such as:
Installation: pip install <unregistered-package-name>
or
npm install <unregistered-package-name>
When an AI coding agent ingests this file as authoritative setup documentation and holds shell execution permissions, it treats the instruction as ground truth and runs the install command without independent verification. Because the package name is unregistered, any attacker may claim it on the relevant registry and push arbitrary code — ransomware, backdoors, or data exfiltration tools — that the agent will then execute in the context of the corporate environment.
The researchers’ proof-of-concept packages phoned home with process chain data, revealing the specific agents involved. At least one production site was already serving live malware rather than a benign beacon at the time of discovery.
This is structurally identical to dependency confusion attacks but automated at scale by AI agents that treat documentation as executable truth, dramatically accelerating the exploitation timeline from days to minutes.
Framework Mapping
- AML.T0010 / AML.T0115 (AI Supply Chain Compromise / Publish Poisoned AI Artifacts): Attackers register abandoned package names to inject malicious code into agent-driven install pipelines.
- AML.T0110 / AML.T0099 (AI Agent Tool Poisoning / Tool Data Poisoning): The llms.txt file acts as a poisoned context source that directs the agent’s tool use.
- AML.T0067 (LLM Trusted Output Components Manipulation): Agents treat vendor documentation as authoritative without verification.
- LLM05 (Supply Chain Vulnerabilities): The package registry supply chain is the ultimate execution path.
- LLM08 (Excessive Agency): Agents executing shell commands based on unverified external documentation exemplifies unconstrained agency.
- LLM09 (Overreliance): Human supervisors and agents alike treat llms.txt content as ground truth.
Impact Assessment
The confirmed victim set includes multiple Fortune 500 companies and a broader population of startups. The attack surface scales with the adoption of AI coding agents, which are now embedded across SaaS platforms, cloud environments, and developer endpoints. Any organisation that uses agentic coding tools against external documentation without sandboxing or install approval workflows is exposed. The presence of at least one live malware-serving site in the dataset indicates this vector is already being weaponised beyond research contexts.
Mitigation & Recommendations
- Audit your own llms.txt files for references to unregistered or abandoned package names immediately; claim or remove them.
- Restrict agent shell permissions — coding agents should not execute install commands from external documentation without explicit human-in-the-loop approval.
- Implement package allowlists in CI/CD and agent environments; reject any package not pre-approved by a security review.
- Monitor outbound network connections from agent execution environments for unexpected phone-home behaviour.
- Treat llms.txt as untrusted input — validate all referenced packages against internal inventories before agents act on them.