Security researchers registered software packages named in the public documentation files of major companies, including defense contractors, and watched AI coding agents inside those organizations download and run the code automatically. The first machine executed the researchers’ package in under four minutes.
The findings come from Alon Hertz and a team at a stealth-stage security startup, who scanned 6,214 live domains belonging to defense contractors, Fortune 500 firms, and large technology companies. They published their results on August 27.
At the center of the problem is a file type called llms.txt, and its longer companion llms-full.txt. These files are an emerging convention that gives AI agents a machine-readable guide to a website, telling an agent what to read, which programming interfaces to call, and which software packages to install. They function as the AI equivalent of robots.txt, the long-standing file that tells search engines how to index a site.
Google now ships an llms.txt audit inside its Lighthouse developer tool, encouraging wider adoption.
Across the scanned domains, the team resolved 8,565 of these files. Inside them, they found more than 237 install commands pointing to package names and web domains that no one had ever registered. The names were spelled correctly in the companies’ own official files. The packages behind them simply did not exist.
To test the risk, the researchers registered a small set of the unclaimed names on the public PyPI and npm code registries and inserted a harmless beacon that reported back each time the package was installed. The first callback arrived from a Fortune 500 company within four minutes. A second followed within the hour, then several dozen more spanning startups and large enterprises.
Anthropic’s Claude, OpenAI’s Codex, and Nous Research’s Hermes all installed the unclaimed code, the researchers said. In testing, a single prompt naming only a vendor was enough to send an agent hunting for that vendor’s llms.txt file and running the install command it found, with no attacker involvement and no malicious link supplied.
“The trust model is broken,” Hertz said. “Agents treat vendor docs as ground truth and don’t question them, and neither do the humans supervising them.”
The team also found one case already being exploited. Documentation from authentication vendor Clerk instructed agents to run a command that, executed on its own, pulled a package from the public npm registry that Clerk had never published.
A third party had registered that name with malicious code cataloged as MAL-2026-11069, which harvests the user name, machine name, and working directory of each system that installs it. Clerk addressed the issue after disclosure.
Standard endpoint defenses did not flag the activity, according to the researchers, because the installs looked like a developer legitimately pulling a package from an approved registry through a sanctioned coding tool.
The exposure carries added weight for the defense-industrial base, where AI coding agents are moving into networks that handle controlled and export-restricted material. The same install path that reached Fortune 500 systems runs through any contractor that publishes agent-readable documentation, and the researchers noted the trust chain extends to third-party vendor and partner files an agent may pull without the host organization’s knowledge.
Hertz said his team plans further work on the wider category of data that agents now treat as executable instructions. The researchers withheld the names of affected companies to protect ongoing remediation.
Click Here For The Original Source.
