Key facts
- AI agents are executing unowned code found in corporate documentation files like 'llms.txt'.
- This vulnerability allows for the potential installation of malware or harmful packages.
- At least one active attack was discovered exploiting this misconfiguration.
- AI agents, including Claude and OpenAI's Codex, were identified as executing the code.
- The trust model is broken as agents treat vendor documentation as ground truth without verification.
AI agents are inadvertently installing unowned and potentially malicious code within corporate networks due to misconfigured documentation files, researchers have discovered. These files, often named 'llms.txt' or 'llms-full.txt', are intended to provide machine-readable summaries of website content for AI consumption. However, when they contain references to unregistered code packages or domains, AI agents with the ability to execute shell commands can be tricked into downloading and running harmful software.
Researchers scanned over 6,000 domains and found 120 files with 227 commands pointing to non-existent packages. By registering some of these unclaimed names, they confirmed that AI agents, including Anthropic's Claude, OpenAI's Codex, and Nous Research's Hermes, would execute the code. This led to a 'phone-home' response from at least one Fortune 500 company, demonstrating a significant supply-chain risk.
The core issue, according to researchers, is a broken trust model where AI agents treat all content within these documentation files as authoritative instructions, failing to distinguish between legitimate commands and potentially malicious ones. This vulnerability, known as prompt injection, means the entire corpus of published data consumed by agents has become an execution surface.
In one instance, a misconfigured file on the legitimate website clerk.com contained a command that, when executed by an AI agent, could have led to the installation of live malware. While Clerk.com has since addressed the specific issue, the broader vulnerability highlights the challenges in securing AI agent interactions with external data sources.