← All articles

llms.txt Vulnerability: How AI Agents Automatically Install Malicious Code via Documentation Files

llms.txt vulnerability: attack via AI agent documentation file

On Thursday, August 27, Ars Technica published an investigation that should make any developer using AI coding agents rethink their security. Researchers from an Israeli stealth startup scanned 6,214 domains belonging to Fortune 500 companies, defense contractors, and Big Tech — and found 120 llms.txt files that cause AI agents to automatically install non-existent packages from PyPI and npm.

The problem is simple and terrifying: llms.txt is essentially "robots.txt for AI" — a markdown site-map file that helps agents quickly understand documentation structure. But the specification includes no authentication, no signatures, no integrity checks. If such a file contains pip install non-existent-package or npm install non-existent-package, and the agent has permission to run commands — it will simply install whatever is written there.

How it works

The researchers found 8,265 llms.txt and llms-full.txt files (many sites host both). In 120 of them — across 120 different domains — there were references to packages or domains that don't exist in the registries. An attacker only needs to register such a name and upload malicious code.

To verify the attack, the researchers themselves registered several "free" names and placed harmless packages that simply ping their server with "I started." Within an hour, they got a response from a Fortune 500 company. Over time, dozens more responses arrived — from other giants and startups. Process telemetry showed exactly who installed the packages: Claude Code, OpenAI Codex, and Hermes from Nous Research.

llms.txt attack diagram

The nastiest case — clerk.com

On the legitimate clerk.com site, the llms.txt file contained npx clerk-next-fix-auth-protection. Unlike a regular npm install, npx can fetch a package into npm's cache and execute its binary without adding it to the project's dependency manifest. Someone managed to claim this free name and upload actual malware. Clerk fixed the issue, but the pattern is already in production.

Why this isn't just a "model bug"

This isn't a hallucination or a sandbox escape. The file sits on the company's official domain, served over HTTPS, in a standardized format designed for AI consumption. The agent has no reason to doubt it — the file is the authority. The problem is that the llms.txt standard (proposed by Jeremy Howard of Answer.AI in September 2024) contains no security provisions whatsoever: no signatures, no origin verification, no package verification.

The trust chain is transitive: llms.txt doesn't have to sit on the Fortune 500's own site — it can be at a partner's docs, a vendor's SDK reference, a community project's setup guide. If the agent trusts that third party, and that third party points to an unregistered package — the chain works the same way.

What to do right now

  1. Audit. Check your llms.txt and llms-full.txt. Ensure every mentioned package, domain, and URL exists, is under your control, and has an identified maintainer. Remove references to dependencies you can't explain from memory.
  2. Proxy between agents and registries. Block new packages (slopsquatted packages are new by definition), enforce a 24–72 hour cooldown after any dependency's first release, verify provenance (SLSA/Sigstore) before installation.
  3. Don't give agents --yolo, --dangerously-skip-permissions, --trust-all-tools. These flags exist so the developer takes responsibility. If an agent installs packages without your confirmation — you've handed it the keys to your infrastructure.

The bottom line

The race to make websites readable for agents just collided with the race to exploit the software supply chain. This isn't one model's or one vendor's fault — it's a design flaw in a standard nobody thought of as executable code. Until the industry enforces validation of what agents read on the web, every bad llms.txt is a potential entry point into your network.

llms.txt attack diagram: agent reads file, finds install command for non-existent package, executes it, loads malware

Want to test your AI workflows for security? NeuralSpace lets you run code generation and test agents in an isolated environment — try the chat or code mode.