Cybersecurity researchers have identified an attack vector in which autonomous AI agents read official llms.txt files hosted on Fortune 500 company websites and independently install malicious packages2.
The llms.txt standard, analogous to robots.txt, is designed to give AI systems a machine-readable description of a product, its API, and instructions for installing necessary packages. AI coding assistants that consume these files treat their contents as authoritative instructions, executing install commands without additional verification.
The problem: many llms.txt files contain errors and references to packages that do not exist in public registries. Researchers analyzed over 8,500 llms.txt files and found more than 237 non-existent or unregistered package names across PyPI, npm, RubyGems, and other registries. An attacker can register a package under one of those phantom names and embed malicious code, turning a legitimate company's own documentation into a supply-chain attack surface.
Israeli security experts tested the vector by registering several fake packages containing minimal telemetry code. Within four minutes, a server belonging to a Fortune 500 corporation automatically downloaded and executed the fake package code.
Researchers also documented a live malicious campaign involving the Clerk authentication service. The Clerk llms.txt file contained an instruction to run a package called clerk-next-fix-auth-protection. No official package by that name existed, so attackers registered it themselves. Clerk has since fixed the file.
ANALYSIS The attack exploits a trust gap specific to the AI-agent workflow: coding assistants treat llms.txt directives the way a human developer might treat verified documentation, but without the judgment to question whether a referenced package is legitimate. The 237-plus phantom packages across multiple registries represent a broad, registry-agnostic attack surface that scales with the adoption of llms.txt as a standard.
The four-minute time-to-execution observed in the Fortune 500 test case indicates that automated pipelines consuming llms.txt files operate with minimal or no human review, compressing the window between a poisoned file going live and a compromised server.
The research was reported by Cybernews on August 31, 20261.