AI agents read legitimate llms.txt files from trusted companies and proceed to install malware

An AI agent visits a company website, checks a legitimate llms.txt machine-readable file, and installs malware. It follows the official instructions that point to non-existent packages. Security researchers have found hundreds of inadvertent mistakes – hackers are already leveraging them, and tricking AI agents into self-compromise.

A cybersecurity research team from Israel demonstrated that compromising Fortune 500 companies is possible simply by checking vendor documentation and claiming non-existent packages referenced in it.

Thousands of companies, including tech giants, fintechs, and defense contractors, already publish llms.txt files on their domains – it’s an emerging convention to provide machine-readable summaries to LLMs and AI agents, similar to robots.txt.

The open question remains: How many of these files were actually read before publication? Researchers scanned them and found hundreds of non-existent packages and domains referenced in the documentation.

“It’s taken 4 minutes for a Fortune 500 company to run code we wrote,” said Alon Hertz, a security analyst and former member of Unit 8200, the Israeli military intelligence unit.

No phishing, no intrusion is required to compromise developers who let their AI agents roam.

The researchers simply published a code package that is cited in one of the llms.txt files and managed to achieve code execution inside “Fortune 500” companies, according to a report titled “Data Becomes Code.”

Moreover, they also found a live malicious campaign exploiting the same gap.

Legitimate llms.txt is a minefield for AI agents

Hertz said his team checked 15,000 major companies and pulled 8,565 llms.txt files across 6,214 live domains. Google instructs developers to place such a file in the site’s root directory to save AI time crawling and understanding primary content.

This file becomes one of the AI’s first interactions with the website, looking for answers on how to use the product, what to read, which APIs to call, which packages to install, and which domains to trust.

“An AI coding agent asked to integrate with that company’s product will read that line and run it,” Hertz explains.

However, in many cases, there is no package to run. The researchers found over 237 unclaimed artifacts referenced as installation or setup instructions, including package names, domains, and subdomains. The non-existent packages span nning multiple ecosystems, such as PyPI, npm, RubyGems, NuGet, crates.io, and Packagist.

“Every one of them was something we could have claimed, most for free.”

The researchers registered several packages using names that appeared in the llms.txt files from well-known companies, embedding minimal code that simply phoned home when installed.

The researchers claim that a machine inside “a multi-hundred-billion-dollar company” installed their package in under 4 minutes.

“The second Fortune 500 callback came within the hour. Then a few dozen more, spanning startups and enterprises with security teams larger than our entire professional network,” Hertz said.

The researchers also disclosed a real-world attack that impersonated Clerk, an authentication vendor. It’s llms.txt that told AI agents to run the command “clerk-next-fix-auth-protection,” which only existed as part of another package. Attackers registered the malicious package with the same name. The company fixed the issue.

The report warns that AI agents have no reason to question official documentation. As AI agents become the first to read, interpret, and act on new data, this creates a whole new attack surface.

“The boundary between data and code has collapsed. Every content on your website is no longer content – it’s operational input,” the report concludes.