Security researchers uncovered a critical vulnerability where AI coding agents like OpenAI's Codex automatically execute malicious code embedded in documentation files published on corporate websites. Over 120 enterprise domains hosted llms.txt or llms-full.txt files containing references to unregistered packages and expired domains. When researchers registered some of these unclaimed names and hosted simple packages designed to phone home, they received callbacks from Fortune 500 networks, defense contractors, and technology firms within minutes.

What Are llms.txt Files and Why Do They Matter?

The llms.txt and llms-full.txt files were created as a machine-readable equivalent to robots.txt, designed to guide AI agents on site content and setup instructions. Companies publish these files to make their documentation AI-friendly, helping coding agents understand how to configure tools and install dependencies. However, this well-intentioned practice has become an unexpected attack surface.

Researchers scanned 6,214 live domains tied to defense contractors, Fortune 500 companies, and major technology firms. They discovered 8,265 llms.txt and llms-full.txt files across these domains. Of those files, 120 contained 227 install commands for packages or domains that nobody owned. The problem is that AI agents treat these vendor-published files as ground truth and execute the instructions without verification.

How Are AI Agents Being Tricked Into Running Malicious Code?

The attack works because AI coding agents see HTTPS-served files on official corporate domains in a standardized format created specifically for machine readers. The agents assume these instructions are legitimate vendor guidance and execute them without signature checks or ownership verification on package registries like PyPI or npm. Process logs from the research confirmed that coding agents powered by Anthropic's Claude, OpenAI's Codex, and Nous Research's Hermes had executed the malicious installs.

One real-world case demonstrated the severity of this vulnerability. The legitimate site clerk.com contained the instruction "npx clerk-next-fix-auth-protection." Someone registered the missing package and loaded it with live malware. Clerk fixed the entry after discovery, but the incident proved the mechanism works against production systems. The npm package manager pulls and executes binaries without adding them to dependency lists, making it perfect for silent compromise.

Steps to Protect Your Organization From llms.txt Vulnerabilities

• Audit Documentation Files: Organizations must systematically review all llms.txt and llms-full.txt files published on their domains and remove references to non-existent packages or expired domains.
• Verify Every Command: Treat these files with the same care once reserved for production code, ensuring every instruction has been validated and tested before publication.
• Implement Package Verification: Configure AI agents to verify package ownership before installation and check domain registration status before executing commands.
• Restrict Agent Permissions: Limit filesystem and shell access for AI coding agents, avoiding auto-approve flags and "YOLO modes" that grant broad permissions without human review.
• Monitor Documentation Generation: If using AI to generate documentation, manually review all package names and installation commands, as AI models frequently hallucinate package names that don't exist.

The vulnerability stems from multiple sources. Many llms.txt files predate widespread AI agent use and contain dangling references from copy-paste errors, abandoned projects, or renamed libraries. Some entries originated from AI-generated documentation, where language models hallucinated package names during the documentation creation process. These harmless references became dangerous once agents gained permission to run shell commands.

"The trust model is broken. Agents treat vendor docs as ground truth and don't question them, and neither do the humans supervising them," said Alon Hertz, a security researcher who conducted the investigation.

Alon Hertz, Security Researcher

Why Endpoint Protection Misses These Attacks?

Endpoint detection systems failed to flag any suspicious activity during the research. The compromise happens in the reasoning layer, in the decision to trust a document and act on its contents. The activity looked like normal developer behavior: package manager commands from approved AI tools, HTTPS traffic to public registries, no anomalous binaries, and no obvious malware signatures. Traditional controls focused on binaries and network beacons lose effectiveness when the attack vector is a trusted instruction file.

The research team, a stealth Israeli startup, captured parent process chains showing the pattern repeated consistently: developer workstation, AI coding agent, package manager, and outbound connection to the researchers' server. This pattern appeared across multiple enterprise networks, demonstrating the widespread nature of the vulnerability.

Similar risks have surfaced before. Earlier this year, researchers described "HalluSquatting," where attackers predict and register names that language models tend to hallucinate. DevOps.com reported success rates as high as 100 percent for certain skill installations across tools including GitHub Copilot and Cursor. However, the llms.txt vector feels different because it weaponizes the very files companies publish to make their content AI-friendly.

What Broader Risks Do AI Coding Agents Create?

Recent incidents reinforce the broader security concerns surrounding AI agents. Cisco's Talos team examined chat logs from compromised endpoints running Claude Code, Codex, Cursor, and Gemini. Hackers used these tools to write malware, hunt vulnerabilities, and build scam chatbots. Some operated through stolen enterprise API keys. Kaspersky documented real attacks where AI agents scanned for credentials after malicious npm packages detected their presence. The Nx supply-chain compromise in 2025 specifically targeted machines running Claude Code, Gemini CLI, or Amazon Q CLI, with auto-approval making the difference as thousands of secrets were exfiltrated.

Anthropic itself has published guidance on containing Claude across its products, acknowledging that granting agents filesystem and shell access creates serious risks. Internal red-team exercises revealed failures even in controlled settings. Yet adoption continues because developers love the productivity gains and companies deploy agents across SaaS platforms, cloud environments, and endpoints.

As agentic systems multiply, security leaders must add documentation hygiene to their monitoring priorities. Every public file becomes potential input for agents running inside the corporate perimeter. The Clerk incident offers a concrete warning: a single line in an official instruction file, a missing npm package, and live malware delivered through a trusted brand's own documentation. The fix came after discovery, but how many other faulty entries remain undiscovered across the internet?