Security researchers at an Israeli stealth startup found that documentation files on more than 100 websites are quietly pointing AI agents toward unregistered packages and domains — some of which, when registered, executed code that phoned home from Fortune 500 networks. The culprit is llms.txt, an emerging standard that gives AI models machine-readable site summaries. Think of it as robots.txt for language models. But unlike robots.txt, which merely tells crawlers what not to index, llms.txt can instruct agents to install code. And plenty of sites have left the door wide open.
The researchers scanned 6,214 live domains belonging to defense contractors, Fortune 500 companies, and Big Tech firms. Among 8,265 llms.txt and llms-full.txt files, 120 pointed to code packages or domain names that no one had registered. So the team registered a handful, hosted packages that would ping their server on execution, and waited. Within an hour, a Fortune 500 company’s machine checked in. Dozens more followed, from other Fortune 500 firms and startups alike. The beacon also traced parent processes, implicating coding agents including Claude, OpenAI’s Codex, and Nous Research’s Hermes. None of those companies responded to requests for comment.
Alon Hertz, one of the researchers, didn’t mince words. “The trust model is broken,” he said. “Agents treat vendor docs as ground truth and don’t question them—and neither do the humans supervising them.”
The attack surface here is genuinely novel. Traditional supply-chain attacks rely on developers copy-pasting malicious code or pulling compromised dependencies. This one exploits the fact that AI agents consume documentation autonomously, often without a human ever reading the file. One misconfigured site was even directing visitors — human or machine — toward live malware. That’s not theoretical risk; it’s an active infection vector.
The implications ripple beyond today’s incident. As coding agents proliferate across SaaS, cloud, and endpoint environments, every unmaintained domain reference in a docs file becomes a potential foothold. The researchers’ proof of concept worked because unregistered domains are cheap to claim and impossible to distinguish from legitimate ones once an agent trusts the source document. Expect this to force a reckoning over how AI agents validate external instructions — and whether llms.txt needs a security model before it becomes ubiquitous.
