IA · 27 August 2026 · 4 min read
Vulnerability in llms.txt: Claude and Codex Run Unverified Code on Corporate Networks
In brief: A study across more than 6,000 corporate and defense domains has exposed a severe AI supply chain vulnerability: llms.txt files, designed to guide large language models, frequently contain references to unregistered packages or unclaimed domains. Autonomous coding agents including Claude, Codex, and Hermes blindly executed installation commands found in these files, pulling proof-of-concept code directly into Fortune 500 internal networks.
by Team Mocchi's
The llms.txt standard and the assumption of implicit trust
Over the past year, the web has rapidly embraced the llms.txt and llms-full.txt file convention. Designed as an AI counterpart to the traditional robots.txt file, these documents sit at the root of a website to provide large language models with a structured, lightweight, machine-readable overview of technical documentation, developer APIs, and platform architectures. Their explicit goal is to optimize information retrieval for AI-driven workflows.
However, as detailed in an investigation by Ars Technica, this emerging standard has introduced a critical security risk due to a fundamental flaw in trust architecture: autonomous AI agents treat vendor documentation as absolute ground truth, executing shell commands without verifying package ownership or domain integrity.
The Fortune 500 testing experiment
Security researchers based in Israel scanned 6,214 live domains belonging to Fortune 500 enterprises, Big Tech corporations, and defense contractors. They identified 8,265 llms.txt and llms-full.txt files across these targets. Within 120 of those domains, the researchers uncovered 227 installation commands pointing to software packages or domain names that were completely unregistered on public repositories such as PyPI or npm.
These files contained outdated drafts or mistyped setup guides featuring prompts like pip install [package-name] or npm install [library]. To test how coding agents handle such instructions, the researchers registered several unclaimed names on official package registries and published harmless proof-of-concept packages designed only to ping their diagnostic server.
The findings confirmed the vulnerability: within an hour, the researchers received their first phone-home beacon from inside the internal network of a Fortune 500 company. Over subsequent weeks, dozens of additional pings were recorded from other major corporations and startups. Process tree analysis confirmed that the installations were initiated directly by prominent coding agents, including Anthropic's Claude, OpenAI's Codex, and Nous Research's Hermes, while assisting engineers or executing automated codebase maintenance.
Supply chain attacks targeting autonomous agents
This vector represents an agentic evolution of classic dependency confusion and typosquatting attacks. When a developer assigns shell execution permissions to a coding assistant, the agent fetches the vendor's llms.txt, extracts dependency requirements, and executes installation commands under the assumption that the provided documentation is secure and authoritative.
If an attacker discovers an abandoned or unregistered package name within a public llms.txt file, they can claim that package on public registries and deploy malicious payloads, ransomware, or persistent backdoors directly to any environment where an agent attempts integration. Researchers noted that at least one misconfigured corporate site was already pointing visitors and automated systems toward active malicious endpoints.
This discovery arrives just as technology providers push for deeper, unattended autonomy. As reported by WIRED, major AI labs are actively experimenting with persistent, proactive agent architectures that can generate and run follow-up tasks in background processes, making automated shell verification and containment controls urgent industry priorities.
Mocchi's take
This research underlines a fundamental flaw in how agentic development workflows are deployed: granting expansive shell permissions without deterministic sandboxing. Letting an AI model interpret external markdown documents and run shell installation commands without pinned dependencies or signature verification is equivalent to running unvetted scripts directly from the open web. Engineering teams adopting autonomous coding tools must enforce strict execution sandboxes, maintain local private package registries, and audit their own llms.txt files to eliminate orphaned dependencies.