A significant cybersecurity vulnerability has been uncovered, revealing that documentation files on over 100 websites are referencing potentially dangerous executable content. This content is automatically installed when visited by various AI agents. Shockingly, several dozen companies, including some Fortune 500 firms, have executed this proof-of-concept code, highlighting a massive gap in AI-driven automation security.

The vulnerability resides within llms.txt and llms-full.txt files. These are emerging web conventions designed to provide machine-readable summaries for AI, acting as the modern equivalent of the traditional robots.txt standard. While intended to help AI understand site structures, misconfigured files are instead directing both humans and AI agents toward live malware and unregistered domains.

The Discovery and Investigation

Researchers from an Israeli stealth startup conducted a massive scan of 6,214 live domains belonging to high-stakes sectors, including defense contractors, Big Tech, and Fortune 500 companies. Out of 8,265 files analyzed, 120 unique sites pointed to unclaimed code packages or domain names. To verify the threat, researchers registered these unclaimed names to host a 'phone-home' beacon.

The results were immediate: within an hour, a beacon response was received from a Fortune 500 company. The investigation eventually mapped the chain of parent processes, revealing that sophisticated coding agents—specifically Claude (Anthropic), Codex (OpenAI), and Hermes (Nous Research)—were the entities executing the unauthorized commands.

Why This Matters

BozokMedia analysis shows that this represents a critical evolution in supply chain attacks. As enterprises integrate autonomous AI agents into their workflows, these agents act as unwitting proxies for attackers. If an agent can be tricked into executing code found in a site's documentation, the entire corporate network becomes vulnerable to remote exploitation.

The autonomy granted to AI agents must be balanced with rigorous execution sandboxing to prevent unauthorized code from traversing corporate perimeters.

As of the time of publication, Anthropic, OpenAI, and Nous Research have not responded to requests for comment regarding the involvement of their models in these security breaches.

Historical Background

For decades, the robots.txt file has been the standard for instructing web crawlers. However, the rapid rise of Large Language Models (LLMs) necessitated a more descriptive format. The current transition to 'llms.txt' is a period of rapid experimentation where security protocols have not yet caught up with the functional requirements of machine-readable documentation.

Frequently Asked Questions

Question 1: How does the code get executed?
AI agents are programmed to parse documentation to understand how to interact with a site. If the 'llms.txt' file contains a command or a link to a package, the agent may attempt to install or run it as part of its automated task.

Question 2: Is this a flaw in the AI models themselves?
It is primarily a failure of the 'instruction following' logic and a lack of execution sandboxing. The models are doing what they are designed to do—follow instructions—but they lack the judgment to identify malicious intent in those instructions.