Security researchers have shown that AI coding agents can be manipulated into installing attacker-controlled packages by following instructions found in organizations’ own llms.txt files.
This research emphasizes how agent-readable documentation can transform unverified package references, expired domains, and abandoned cloud subdomains into execution paths within enterprise environments.
Researchers Execute Code Inside Fortune 500 Companies
The issue revolves around llms.txt and llms-full.txt files, a growing convention designed to provide large language model (LLM) agents with structured guidance regarding a company’s products, documentation, APIs, software development kits, and installation workflows.
Unlike conventional web pages meant primarily for human readers, these files can contain direct operational guidance, including commands such as `pip install`, `npm install`, `npx`, API endpoints, package names, and links to relevant resources.
When an autonomous coding agent retrieves the file while working on a development task, it may treat those instructions as authoritative since they are obtained from the vendor’s official HTTPS domain.
Researchers analyzed 8,565 llms.txt files across 6,214 active domains from a catalog of approximately 15,000 organizations. The dataset notably included Fortune 500 companies, major technology firms, fintech providers, and defense contractors.
During their review, researchers identified more than 237 unclaimed artifacts referenced in agent-facing instructions.
These artifacts included package names from PyPI, npm, RubyGems, NuGet, crates.io, and Packagist, as well as expired domains and unclaimed deployments on platforms like Vercel, Render, Fly, and Netlify.
This issue is not typical typosquatting; in these cases, the package or destination name was correctly spelled in the official documentation but had never been registered or retained by the organization that referenced it.
To validate the risk, the researchers registered a limited number of unclaimed package names and embedded a benign callback beacon.
They reported receiving their first installation callback from a Fortune 500 environment in less than four minutes, followed by another within an hour. The packages did not deploy persistence or collect sensitive data, as per the disclosure.
These findings indicate that an AI agent can autonomously discover a vendor’s documentation, locate the llms.txt file, identify an installation command, and retrieve an attacker-controlled package without needing a phishing lure, exploited vulnerability, or direct interaction from the attacker.
The researchers also identified a real-world example involving Clerk documentation. Clerk’s agent-oriented guidance instructed users to execute `npx clerk-next-fix-auth-protection`, a command associated with functionality in the vendor’s `@clerk/eslint-plugin` package.
However, if the relevant package is not installed locally, `npx` may attempt to resolve the bare command name through the public npm registry.
Researchers AlonHertz1 noted that Clerk had not published a standalone package under that name, leaving it available for third-party registration.
A malicious package using that name was registered and tracked as MAL-2026-11069. This package allegedly executed install hooks that transmitted the installer’s username, hostname, working directory, and timestamp to an external server. Clerk was notified and responded promptly, according to the researchers.
Traditional endpoint controls may struggle to identify this activity because the execution chain resembles typical developer behavior: an approved AI coding tool invokes a standard package manager, which connects to trusted registries such as PyPI or npm.
The critical failure occurs before endpoint telemetry can be helpful. An agent accepts first-party documentation as trustworthy but does not necessarily verify whether a referenced package, namespace, domain, or cloud deployment is actually under the vendor’s control.
This research highlights a broader security concern related to AI agents: the content they consume increasingly functions as executable operational input.
Organizations that publish AI-readable documentation should inventory every referenced artifact, reserve package and domain names, validate command examples, and continuously monitor for abandoned or hijacked dependencies.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
