Coding agents from Anthropic, OpenAI, and Nous Research installed unowned code inside Fortune 500 networks after reading documentation files that pointed at package names nobody had registered. Researchers at a stealth Israeli startup scanned 6,214 domains belonging to defense contractors, Fortune 500 firms, and Big Tech, found 8,265 llms.txt and llms-full.txt files, and flagged 120 of them — each on a different site — as referencing code packages or domains that did not exist. Within an hour of hosting proof-of-concept packages under those unclaimed names, they got their first phone-home response from a Fortune 500 company. A few dozen more followed.
The parent-process chain in the beacon told the researchers exactly what had done the install: Claude, OpenAI's Codex, and Nous Research's Hermes, running with permission to execute shell commands. Anthropic, OpenAI, and Nous Research did not respond to requests for comment. Across the 120 misconfigured files, the researchers counted 227 install commands pointing at code that could be silently claimed by anyone with a PyPI or npm account and a few minutes.
llms.txt and llms-full.txt are a young convention — the AI-era equivalent of robots.txt — meant to give agents a machine-readable summary of a site's content. Sites publish them at their own domains, over HTTPS, and agents treat them as authoritative setup documentation. When one of those files says 'pip install internal-tool' or 'npm install some-package,' the agent runs the command. It does not check whether the package actually exists in the registry, whether the namespace belongs to the vendor, or whether the linked documentation domain expired three months ago.
Key facts
- 01Researchers scanned 6,214 live domains and found 8,265 llms.txt and llms-full.txt files, with 120 files pointing to unregistered packages or domains.
- 02The 120 misconfigured files contained 227 install commands referencing code nobody owns — any of which an attacker can claim.
- 03Within one hour of the researchers hosting proof-of-concept packages, a Fortune 500 company's agent phoned home; a few dozen more followed.
- 04Parent-process logs showed [Claude](/claude), [OpenAI](/openai)'s Codex, and Nous Research's Hermes running the installs autonomously.
- 05Clerk.com hosted an llms.txt entry — 'npx clerk-next-fix-auth-protection' — that someone had already claimed and weaponized with live malware.
That gap is the vulnerability. An attacker who notices an unregistered package name in a published llms.txt can register it, upload arbitrary code, and wait for the next agent to arrive. The researchers demonstrated the pattern by registering a handful of the unclaimed names with benign beacons, and the beacons started firing from real corporate networks almost immediately.
The Clerk case was the clearest live example. On the legitimate clerk.com domain, an llms.txt file instructed agents to run 'npx clerk-next-fix-auth-protection.' Someone had already claimed the empty slot and used it to host live malware. Clerk has since resolved the problem and noted that if an agent had already installed a binary bundled with @clerk/eslint-plugin, the malicious package would not run. Otherwise, it would.
Alon Hertz, one of the researchers, framed the risk as broader than prompt injection.
“Here, the instruction itself can be completely benign and come from a legitimate source—a real company's own documentation—with no malicious actor involved at the time it was written. The danger comes later, when the package or domain it points to is abandoned.”— Alon Hertz, Security researcher
Endpoint detection tools were structurally unequipped to see the attack. To any EDR or corporate proxy, the traffic looked like a developer running pip install from pypi.org — a domain every enterprise proxy already allows — with a company-sanctioned coding agent as the parent process. No anomaly, no alert. The failure sits upstream of the endpoint, in the gap between an instruction fetched from the open web and the shell command an agent runs on the strength of it.
How 227 dead install commands ended up in vendor documentation in the first place is unclear. Some of the faulty entries predate the AI era and were copied from older, non-LLM documentation. Others appear to have been written by AI systems that either hallucinated package names or, like the agents now consuming those files, could not tell the difference between a valid instruction and a fabricated one. The rot compounds: models write docs, models read docs, and nobody in the chain checks the registry.
There are real mitigations available today, and vendors are not without options. Coding agents can be configured to require human approval before executing installs, to verify package ownership against a vendor allow-list, or to refuse commands that reference recently registered namespaces. Registries themselves could hold reserved namespaces for known vendors. None of that is exotic engineering — it is the kind of guardrail that follows every major agentic-security disclosure, and it will follow this one.
The counterweight worth naming: this research comes from a stealth startup with an incentive to make the problem sound urgent, and the count of confirmed corporate infections remains at zero. The researchers documented executions of benign beacon code, not ransomware payloads. The Clerk incident is the only in-the-wild malicious claim they surfaced, and Clerk closed it. What the paper proves is that the attack path works and that agents inside major companies will walk down it — not that a breach has yet happened at scale.
The bigger shift for the AI market is that the surface area of the software supply chain has just expanded to include every piece of documentation an agent might read. Coding agents are already the fastest-growing enterprise AI use case, and every vendor selling them — Anthropic, OpenAI, Nous, and the wave of agent frameworks built on top — now inherits a class of supply-chain risk that traditional package-integrity tooling was not built to see. Expect the next round of agent releases to ship with registry-verification guardrails on by default. It is a solvable problem, and the labs that solve it first will have an easier time selling into the Fortune 500 accounts whose agents just phoned home.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
