Security researchers uncovered a startling weakness in how companies publish instructions for AI coding tools. They scanned thousands of corporate websites. What they found exposed a new attack path that turns documentation into executable threats.
Over 120 enterprise domains hosted llms.txt or llms-full.txt files containing references to unregistered packages and expired domains. These files, meant to guide AI agents on site content and setup steps, instead pointed to code that didn’t exist. Researchers claimed some of those names. They watched real corporate machines reach out within minutes.
Phantom Packages Meet Agentic Trust
The experiment started with a sweep of 6,214 live domains tied to defense contractors, Fortune 500 companies and big technology firms. The team discovered 8,265 llms.txt and llms-full.txt files. Of those, 120 contained 227 install commands for packages or domains nobody owned, according to Ars Technica.
They registered a handful of the unclaimed names. Hosted simple packages designed to phone home. Less than an hour later the first callback arrived from a Fortune 500 network. Dozens more followed, some from additional large enterprises and startups. Process logs left no doubt. Coding agents powered by Anthropic’s Claude, OpenAI’s Codex and Nous Research’s Hermes had executed the installs.
“The trust model is broken,” researcher Alon Hertz told interviewers. “Agents treat vendor docs as ground truth and don’t question them—and neither do the humans supervising them.”
But. The files weren’t planted by attackers. Many predated widespread AI agent use. Humans wrote them. Or earlier LLMs hallucinated package names during documentation generation. Copy-paste errors. Abandoned projects. Renamed libraries. All created dangling references that sat harmlessly until agents gained permission to run shell commands.
One real-world case stood out. The legitimate site clerk.com contained the instruction “npx clerk-next-fix-auth-protection.” Someone registered the missing package and loaded it with live malware. Clerk fixed the entry. Yet the incident proved the mechanism works against production systems. npx pulls and executes binaries without adding them to dependency lists. Perfect for silent compromise.
And the agents didn’t hesitate. They saw HTTPS-served files on official corporate domains. Standardized format created specifically for machine readers. Instructions that looked exactly like vendor guidance. No signature checks. No ownership verification on PyPI or npm. Just execution.
This isn’t theoretical. A stealth Israeli startup conducted the scan. Their beacon captured parent process chains. The pattern repeated. Developer workstation. AI coding agent. Package manager. Outbound connection to the researchers’ server. Endpoint detection saw nothing unusual. Legitimate tools doing what they were configured to do.
Similar risks have surfaced before. Earlier this year researchers described “HalluSquatting,” where attackers predict and register names that LLMs tend to hallucinate. DevOps.com reported success rates as high as 100 percent for certain skill installations across tools including GitHub Copilot and Cursor.
Yet the llms.txt vector feels different. It weaponizes the very files companies publish to make their content AI-friendly. The convention emerged as a robots.txt equivalent for large language models. Now it creates an execution surface spanning the public internet.
Security teams face hard questions. How many internal wikis, partner portals and vendor docs contain similar dangling references? Who audits them? Most agents run with broad permissions because developers want speed. Auto-approve flags. YOLO modes. Trust-all-tools settings. All common.
Clerk resolved its specific issue. The company noted that existing installations of its legitimate @clerk/eslint-plugin package would have blocked the malicious substitute. Small consolation. The broader pattern remains.
Enterprises have poured resources into AI agents. They promise faster development. Autonomous troubleshooting. Code generation at scale. But every new capability expands the attack surface. Agents read files. They run commands. They follow instructions found online. The boundary between data and code dissolves.
“An agent doesn’t distinguish between a page and a command,” the researchers wrote in their analysis. “Everything it reads is input, and every input is a potential instruction.”
Recent incidents reinforce the point. Cisco’s Talos team examined chat logs from compromised endpoints running Claude Code, Codex, Cursor and Gemini. Hackers used the tools to write malware, hunt vulnerabilities and build scam chatbots. Some operated through stolen enterprise API keys. Axios reported the findings in early August.
Kaspersky documented real attacks where AI agents scanned for credentials after malicious npm packages detected their presence. The Nx supply-chain compromise in 2025 specifically targeted machines running Claude Code, Gemini CLI or Amazon Q CLI. Auto-approval made the difference. Kaspersky detailed how thousands of secrets were exfiltrated.
Anthropic itself has published guidance on containing Claude across its products. The company acknowledges that granting agents filesystem and shell access creates serious risks. Internal red-team exercises revealed failures even in controlled settings. Anthropic shared lessons from those efforts in May.
Yet adoption continues. Developers love the productivity gains. Companies deploy agents across SaaS platforms, cloud environments and endpoints. The supply-chain surface grows with them.
Clean documentation offers the most immediate defense. Organizations must audit llms.txt files. Remove references to non-existent packages. Verify every command. Treat these files with the same care once reserved for production code.
Longer term, agents need better boundaries. They should verify package ownership before installation. Check domain registration status. Distinguish between human-written instructions and retrieved web content. Current models struggle with that separation. Prompt injection problems stem from the same root.
The Israeli researchers put it bluntly in their Medium post. Data became code. Companies published files for AI agents. Those files quietly turned into execution paths inside Fortune 500 networks. The post expands on the trust chain failures.
Endpoint protection missed every step. The activity looked like normal developer behavior. Package manager commands from approved AI tools. HTTPS traffic to public registries. No anomalous binaries. No obvious malware signatures.
This gap matters. As agentic systems multiply, traditional controls focused on binaries and network beacons lose effectiveness. The compromise happens in the reasoning layer. In the decision to trust a document and act on its contents.
Security leaders already track shadow AI. Unapproved accounts. Personal API keys. Now they must add documentation hygiene to the list. Every public file becomes potential input for agents running inside the perimeter.
The Clerk incident offers a concrete warning. A single line in an official instruction file. A missing npm package. Live malware delivered through a trusted brand’s own documentation. The fix came after discovery. How many others remain?
Researchers suspect some faulty entries originated from AI-generated docs. The same models that hallucinate code also hallucinate setup instructions. Those instructions then get published. Agents later consume them. The loop closes.
Fortune 500 teams triggered the beacons. Defense contractors hosted problematic files. Big tech domains appeared in the dataset. The problem crosses sectors. It doesn’t require sophisticated social engineering or zero-day exploits. Just an unclaimed name and an agent with execution rights.
Companies that rushed to deploy autonomous coding tools now face the bill. Permissions granted in the name of velocity created new risks. Documentation that seemed harmless became dangerous when agents gained agency.
The findings, first detailed by Ars Technica on August 27 and covered by TechRadar two days later, arrived at a moment of heightened scrutiny. Other reports this summer showed attackers using similar AI tools offensively. Low-skilled operators leveraged Claude and Codex to breach multiple organizations. Help Net Security examined recovered agent sessions that revealed the pattern.
Unit 42 analysts tracked AI-enabled malware trends through August. Most samples remained proof-of-concept. Yet the trajectory pointed toward greater integration of agentic capabilities in real attacks. Palo Alto Networks published the assessment on August 25.
Defenders cannot simply block the tools. Developers need them. Productivity demands them. Instead, organizations must redesign the trust assumptions baked into agent deployments.
Require human confirmation for package installations. Implement namespace verification. Log the source document for every executed command. Treat llms.txt files as untrusted input despite their official appearance.
The alternative looks clear. More silent infections. More supply-chain incidents triggered not by malicious code but by absent code. More Fortune 500 networks phoning home to unexpected destinations because an agent followed instructions that should never have been there.
AI agents don’t see the difference between documentation and directives. They execute what they read if granted permission. That simple fact just rewrote the rules for enterprise security. Companies are only beginning to understand the consequences.
Discover more from Web and IT News
Subscribe to get the latest posts sent to your email.