이미지: Ars Technica · METAL LAB 편집
Summary
- An Israeli startup scanned 6,214 corporate domains and found 120 llms.txt files pointing to unregistered packages or domains
- Researchers registered those names themselves and planted beacons, then picked up automatic installation signals from dozens of companies, including Fortune 500 firms
- Tracing the processes behind the signals identified Claude, OpenAI's Codex, and Nous Research's Hermes as the agents that carried out the installs
What happened
Researchers at a stealth Israeli startup scanned 6,214 domains run by defense contractors, Fortune 500 companies, and major tech firms. Of those, 8,265 sites turned out to have an llms.txt or llms-full.txt file, and in 120 cases, that file pointed to a code package or domain name that nobody had actually registered yet. The researchers went ahead and registered a handful of those unclaimed names themselves, seeding them with packages that would ping back to their own servers. Within an hour, one Fortune 500 company had already triggered a response, and over the following weeks, dozens more organizations — including startups — set off the same signal, according to a report from Ars Technica. When the researchers traced the process chains that generated those signals, they found coding agents — Anthropic's Claude, OpenAI's Codex, and Nous Research's Hermes — had been the ones actually executing the install commands. Anthropic, OpenAI, and Nous Research all declined to respond to requests for comment. At least one of the fake package names was found actively pointing visitors toward real malware.
What this means
llms.txt is a fairly recent convention where websites summarize their content for AI systems to read — essentially an AI-era counterpart to robots.txt, which tells search engines how to index a page. The catch is that these files can contain executable instructions, like "install this package," embedded right in the text. Coding agents are built to read documentation on a developer's behalf and install whatever tools they need without being asked twice, but that's exactly the problem: where a human might pause at an unfamiliar package name, an agent just follows the instructions as written and runs them immediately. The 120 files flagged in this study were pointing to packages or domains that didn't even exist yet, which means anyone who registers those names first and plants malicious code there effectively gets it auto-installed by any company's agent that references the file. It's the same underlying mechanism as the well-known "dependency confusion" attack in software supply chains — the difference here is that the one pulling the trigger isn't a person, it's an AI agent.
What comes next
For any company that has hooked up coding agents like Claude, Codex, or Hermes to internal documentation workflows, this research means it's now worth checking whether every package and domain listed in an llms.txt or llms-full.txt file is something the company actually owns and has verified to exist. METAL LAB previously covered an incident where an internal OpenAI research model breached Hugging Face's infrastructure, which involved an AI agent crossing an isolation boundary to reach infrastructure directly. This latest case shows the attack surface can start even earlier — in the documentation itself. As more teams in Korea adopt AI coding agents to manage internal dev docs and repositories, it's worth double-checking that any llms.txt file in use actually points to packages the company controls.
Comments