Security researchers have discovered that AI coding agents including Anthropic's Claude, OpenAI's Codex, and Nous Research's Hermes automatically install unowned code referenced in llms.txt files on corporate websites, creating a dangerous new attack vector. Within an hour of registering a handful of unclaimed package names, researchers received callbacks from a Fortune 500 company, and over time dozens more – including from other Fortune 500 firms and startups – responded. One misconfigured site was found to be directing visitors to live malware.
A stealth startup in Israel has uncovered a critical security flaw in how AI coding agents interact with a growing web convention. The llms.txt and llms-full.txt files, modeled after the robots.txt standard used by search engines, are designed to help artificial intelligence systems understand a website's structure and content. But researchers found that by planting references to unregistered code packages in these files, they could trick agents into downloading and executing software from attacker-controlled servers.
The research team scanned 6,214 live domains belonging to defense contractors, Fortune 500 companies, and Big Tech firms. They identified 8,265 llms.txt or llms-full.txt files across those sites, of which 120 pointed to domain names or code packages that were not registered. To test the exploit, the researchers registered several of those unclaimed names and hosted packages that, when executed, sent a signal back to their infrastructure. Within an hour, a Fortune 500 company's internal systems responded. Over the following days, dozens more callbacks were recorded.
The beacon also captured the parent process chain, revealing that three major coding agents were responsible for initiating the installs: Anthropic's Claude, OpenAI's Codex, and Hermes (developed by Nous Research). The finding suggests that these agents automatically follow instructions in llms.txt files without verifying the safety or ownership of the referenced packages, effectively opening a backdoor into corporate networks.
At least one misconfigured site was found to be serving live malware to any visitor – human or AI – that followed the links in its llms.txt file. While the researchers' own test only involved proof-of-concept beacons, the potential for real harm is clear: an attacker could use this technique to deploy ransomware, steal data, or establish persistent access.
As of publication, Anthropic, OpenAI, and Nous Research had not responded to requests for comment. The researchers suggest that companies using AI coding agents should immediately review their llms.txt files and restrict which packages agents are permitted to install automatically. The find underscores a growing concern in the AI safety community: that agents, designed to be helpful, can be easily weaponized when they trust instructions from untrusted sources.
Analysis
Why This Matters
- Network compromise via AI agents: Any company using coding assistants like Claude, Codex, or Hermes could be exploited if an attacker controls a reference in an llms.txt file on a visited website.
- Supply chain attack at scale: The vulnerability is not limited to one vendor – it affects any AI agent that automatically installs dependencies from web-published manifests.
- Inexperienced adoption: Many organizations are adding llms.txt files without understanding the security implications, creating a broad attack surface.
Background
The llms.txt convention emerged in 2025 as a simple way for websites to provide machine-readable summaries to AI agents. It mirrors the robots.txt standard, but unlike robots.txt – which instructs crawlers what to avoid – llms.txt actively tells agents what to fetch and sometimes what to execute. Security researchers had previously warned that this trust should not be implicit. The Israeli startup's scan targeted domains of high-value organizations, including defense and Fortune 500 companies, to test real-world exposure. The speed of callback (within one hour) demonstrates that agents are constantly scanning and acting on these files in corporate networks.
Key Perspectives
[Researchers (stealth startup)]: They argue this is a critical design flaw in how AI agents handle web content. By registering unowned packages, they proved that agents execute code without verification. The next step is for AI vendors to implement sandboxing or permission checks.
[Enterprises using AI coding agents]: They may be unaware that their agents are making unsafe installations. The vulnerability highlights the need for internal policies on agent permissions, network monitoring, and vetting of external dependencies referenced in llms.txt files.
[AI vendors (Anthropic, OpenAI, Nous)]: These companies will need to update their agents to either ignore executable references in llms.txt or require user confirmation before installing packages. Failure to do so could lead to widespread exploits and liability.
[Critics/Skeptics]: Some might argue that the risk is overstated because the attack requires the victim to visit a compromised or malicious site, and that proper corporate security should already block arbitrary package installs. However, the researchers note that agents often work autonomously and may visit many sites in a session, making this a realistic threat.
What to Watch
- Official responses from Anthropic, OpenAI, and Nous Research – will they patch their agents or issue warnings?
- Adoption of security extensions to llms.txt, such as digital signatures or allowlists.
- Real-world exploitation – whether attackers begin using this technique before mitigations are in place.