AI coding agents executed unverified code via misconfigured llms.txt files
Researchers discovered that AI coding agents including Claude, Codex, and Hermes executed unverified code from misconfigured llms.txt files on corporate networks. The agents treated machine-readable documentation files as authoritative instructions without verification, allowing attackers to register unclaimed package names and distribute malware to multiple Fortune 500 companies and defense contractors.
What happened
Security researchers found 120 misconfigured llms.txt files across 6,200 scanned domains that contained references to unregistered code packages and unclaimed domain names.
The researchers registered several unclaimed package names and hosted beacon code to test vulnerability. Within an hour, they received signals from a Fortune 500 company, and over time collected dozens more responses from various enterprises.
Analysis revealed that AI coding agents including Claude, Codex, and Hermes were downloading and executing the test code. At least one active exploitation case was documented involving malware hosted under a previously unclaimed package name.
Reported impact
Defense contractors, Fortune 500 companies, and technology firms had their corporate networks exposed to code execution through AI agents following malicious llms.txt instructions.
The vulnerability allowed attackers to register unclaimed package names referenced in llms.txt files and distribute malware to companies whose AI agents would execute the code without verification.
Index analysis
AI agents treat llms.txt files as authoritative documentation without verification, unable to distinguish between legitimate instructions and untrusted content. Every piece of information an AI agent reads during web browsing is treated as potential instruction.
The faulty entries in llms.txt files may have originated from manual human error or from AI systems unable to distinguish legitimate from illegitimate instructions.
Governance controls
Researchers recommended clean documentation practices and restricting AI agents from treating documentation as executable instructions. One affected company, Clerk, resolved its issue after being notified of the problem.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.