AI Agents May Be Installing Dangerous Code Hidden in llms.txt Files

Security researchers have discovered potentially dangerous executable content referenced by documentation files on more than 100 websites. The content can be automatically installed or accessed when processed by certain AI agents. Dozens of organizations, including Fortune 500 companies, executed proof-of-concept code during testing, while at least one misconfigured website directed both human visitors and AI agents to live malware.

The issue involves llms.txt and llms-full.txt files. Introduced as a machine-readable way to summarize a website’s content and structure, these files are designed to help AI systems navigate online information. The format is similar in concept to robots.txt, which provides instructions to search engine crawlers.

However, unlike robots.txt, llms.txt files may contain links and instructions that AI coding agents interpret as trusted documentation. Google Lighthouse, a web development tool, now includes additional guidance and auditing features for llms.txt files. More information is available here. Examples of properly configured files from Cloudflare can be found at llms.txt and llms-full.txt.

How Did Researchers Discover the Security Risk?

Researchers at an Israeli cybersecurity startup scanned 6,214 active domains associated with defense contractors, Fortune 500 companies, and major technology firms. They identified 8,265 llms.txt and llms-full.txt files, with many websites hosting both versions.

Among those files, 120 hosted on separate domains referenced one or more unregistered software packages or domain names. To determine what would happen when AI agents processed the files, the researchers registered several of the abandoned names and published test packages designed to notify their servers when accessed.

Within an hour, the researchers received a callback from a Fortune 500 company. Over the following weeks, they identified dozens of additional connections involving large enterprises and startups. Their tracking beacons also recorded the parent processes responsible for launching the installations, revealing the involvement of AI coding tools including Claude, OpenAI Codex, and Nous Research’s Hermes.

Anthropic, OpenAI, and Nous Research had not responded to requests for comment at the time of publication.

Why AI Documentation Files Create a Supply-Chain Risk

“The trust model is broken,” one of the researchers, Alon Hertz, said in an interview. “Agents treat vendor documentation as truth and don’t ask questions, and neither do the humans overseeing it.”

As organizations increasingly deploy AI agents across software-as-a-service platforms, cloud environments, developer tools, and endpoints, trusted documentation can become an unexpected attack surface. If an llms.txt file references an unclaimed package or expired domain, an AI agent may attempt to retrieve or install it without adequate verification.

The researchers warned that the rapid growth of AI agents is expanding the software supply-chain threat landscape. Organizations should review llms.txt and llms-full.txt files, remove outdated references, verify every linked package and domain, and require human approval before AI systems install executable code.