Key Takeaways
- Over 100 websites contain misconfigured files that could execute harmful code.
- Research identified AI agents, including Claude and Codex, involved in executing unregistered commands.
- Misconfigured files may lead to security breaches in major corporations.
- The distinction between data and executable code is increasingly blurred.
Security Risks from Misconfigured Files
Documentation files on more than 100 websites have been found to reference potentially harmful executable content that installs automatically when accessed by AI agents. Several companies, including some Fortune 500 firms, have executed proof-of-concept code. Alarmingly, at least one misconfigured site directs both human and AI visitors to live malware.
The problematic content is located in llms.txt and llms-full.txt files, which websites use to offer machine-readable summaries of their content. These files serve a similar purpose to the robots.txt standard, guiding search engines on how to index site content. Properly configured examples for Cloudflare can be found in relevant documentation.
Research Findings
A team of researchers from a stealth startup in Israel scanned 6,214 live domains belonging to defense contractors, Fortune 500 companies, and major tech firms. They discovered 8,265 llms.txt and llms-full.txt files, with 120 of them pointing to unregistered code packages or domain names. To investigate, the researchers registered some of these unclaimed names and hosted packages that prompted any machine executing them to connect to their server. Within an hour, they received responses from a Fortune 500 company, followed by several others, including startups. Their monitoring revealed that coding agents like Claude, OpenAI’s Codex, and Nous Research’s Hermes were involved. Attempts to reach Anthropic, OpenAI, and Nous Research for comments went unanswered by the time of publication.
“The trust model is broken,” stated Alon Hertz, one of the researchers. “Agents treat vendor documentation as absolute truth and do not question it, nor do the humans overseeing them. With the rapid growth of agentic AI, the supply-chain surface is expanding, and current safeguards are inadequate.”
Exploit Potential
The misconfiguration stems from files listing non-existent packages from repositories like PyPI and npm, along with installation instructions. For instance, one file included the command pip install [redacted], while another had npm install [redacted]. Since the package names are unregistered, an attacker could claim one and use it to host ransomware or other harmful software. This vulnerability arises when a coding agent with permission to execute shell commands treats the file as legitimate setup documentation, leading to the download and execution of harmful packages.
In one instance, the researchers found an LLM file on the legitimate website clerk.com containing the command npx clerk-next-fix-auth-protection. Unlike standard installation commands, npx can fetch a package into npm’s cache and execute its binary without adding it to the project’s dependency manifest. The researchers later discovered that someone had claimed this previously empty slot and used it to host live malware.
Clerk has since addressed the issue, noting that if an agent had already installed a binary from the package @clerk/eslint-plugin, there was no threat. However, it remains unclear whether this confusion led to actual infections.
AI Limitations and Security Implications
This newly identified threat highlights the limitations of AI systems. Large language models struggle to differentiate between genuine user instructions and content from untrusted sources. Instructions found in retrieved content can be executed just as easily as user-entered commands, unless specific safeguards are implemented. This ongoing challenge has led to prompt injections.
“An agent doesn’t distinguish between a page and a command,” the researchers noted. “Everything it reads is input, and every input is a potential instruction. The entire corpus of published data that agents consume has silently become an execution surface, and most of it lacks the integrity guarantees we apply to actual code.”
The 120 misconfigured files contained 227 commands for installing non-existent packages or accessing unclaimed domains. The origins of these faulty entries are unclear, with many predating the AI era and likely created by humans. Some may have been generated by AI that either hallucinated or failed to differentiate between legitimate and illegitimate instructions.
Blurring Lines Between Data and Code
The researchers elaborated on the security implications, stating that existing controls might not detect these issues because the signals they rely on are misleading.
When an AI agent encounters an llms.txt file, it perceives it as a legitimate document served over HTTPS from the company’s official domain, formatted for AI consumption. The agent has no reason to question its authenticity. If the file instructs pip install internal-tool, the agent executes the command without verifying its legitimacy.
The trust chain extends beyond the Fortune 500’s website. Agents may pull context from trusted third parties, such as a partner’s documentation or a vendor’s SDK reference. If the agent trusts that third party, it will follow instructions pointing to unclaimed packages, perpetuating the risk.
Endpoint detection systems may not flag these actions, as they appear to be legitimate commands executed by a developer using a recognized package manager. The failure occurs upstream, where the instruction and execution diverge. The endpoint may be defenseless, as it was never programmed to ask the right questions.
This research underscores that the distinction between data and executable code is fading. Anything an agent processes could become an instruction if it has the authority to run commands.
“The Clerk case is the clearest example,” the researchers concluded. “The command resembled something the vendor would provide—because it was in their own instruction file. The only missing element was the name in the registry. Every layer of trust was intact except the one that was overlooked.”
The root of this issue mirrors the cause of prompt injections. However, this vulnerability is broader in scope. Hertz explained, “In a prompt injection, someone intentionally embeds malicious instructions. Here, the instruction can originate from a legitimate source—a real company’s documentation—without any malicious intent at the time of writing. The risk arises later when the package or domain it references is abandoned and claimed by someone else.”
This problem extends beyond llms.txt and llms-full.txt files on websites. Instructions, whether implicit or explicit, are present wherever an agent navigates. The diminishing boundary between data and code, coupled with the rapid deployment of AI by major tech companies, raises significant security concerns for the future.
