Researchers trick Fortune 500 AI agents into running malicious code via llms.txt files

As search engines popularised robots.txt to direct web crawlers, a newer file type — llms.txt — has emerged to provide AI agents with concise setup instructions, language dependencies, and installation steps. Researchers from the security firm Pandex found that many of these files contain references to software packages that no longer exist, are misspelled, or have been moved, creating opportunities for attackers to hijack the automated pipelines.

Across 8,565 llms.txt files examined, the team identified 237 references to packages spanning PyPI, npm, RubyGems, NuGet, crates.io, and Packagist that were either abandoned, mistyped, or hosted on expired domains — including .dev and .io registrations and subdomains on Render, Vercel, Fly, and Netlify — all free to claim.

Exploiting this, the researchers published their own Python and Node.js packages designed to call back to a command server. Within four minutes of going live, an AI agent from an unidentified Fortune 500 company executed the malicious code. The team also discovered that a real malware package had already been deployed using the same technique; they notified the affected software publisher.

The attack vector relies on a single line of instruction: telling the AI agent to build and run a project using the vendor's SDK, causing it to fetch and install the counterfeit package as part of its normal workflow.

Why This Matters

Demonstrates a practical, low-effort supply-chain attack on AI agents, which are increasingly used by large enterprises for automation.
Undermines the assumption that data files like llms.txt are safe to trust; any instruction that leads to package installation becomes a code execution risk.
Likely to prompt industry-wide re-evaluation of how AI agents verify the integrity of dependencies they fetch.

Background

llms.txt is a text file placed on websites to give AI agents a quick overview of how to interact with a product — similar to robots.txt for search engines but written for large language model-driven bots. It commonly includes setup commands, environment requirements, and install instructions. Because many AI agents are granted permission to execute shell commands, a malicious or outdated reference in llms.txt can lead to the installation of malware. The problem mirrors classic supply-chain attacks on package registries but is amplified by the automated, trust-based nature of AI agents.

Key Perspectives

Security researchers (Pandex): They argue that the distinction between data and code is dead — an instruction in a file is effectively executable. Their findings highlight a widespread vulnerability that needs immediate attention from both AI developers and enterprises deploying autonomous agents. Companies using llms.txt: Many may be unaware that files published for benign purposes—like helping chatbots answer questions—can be weaponised. While not malicious themselves, their out-of-date or imprecise instructions expose their systems to risk. Critics and skeptics: Some may note that the attack requires the AI agent to have permission to install packages and execute arbitrary commands, which not all agents do. However, the fact that a Fortune 500 agent did so within minutes suggests such permissions are common.

What to Watch

Whether major package registries (PyPI, npm, etc.) tighten verification of package names to reduce typosquatting.
If companies begin scanning their llms.txt files for stale or dangerous references and implement expiration checks.
Potential regulatory or industry guidance from bodies like OWASP on AI agent safety.

ZOTPAPER