Researchers find 237 unclaimed packages in llms.txt files, enabling AI agent malware attacks

August 31, 2026 at 03:46 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Security researchers found 237 unclaimed packages and domains referenced in companies' llms.txt files, allowing attackers to inject malicious code into AI agents. A test package ran inside a Fortune 500 company in under four minutes. A live campaign impersonated Clerk by registering a package name from its llms.txt file.

Key Facts

Researchers found 237 unclaimed packages and domains in company llms.txt instruction files.
A test package ran inside a Fortune 500 company in under four minutes.
A real campaign impersonated Clerk by registering a package name referenced in its llms.txt file.
The research team checked 15,000 major companies and pulled 8,565 llms.txt files across 6,214 live domains.

The Vulnerability

An AI agent visits a company website, checks a legitimate llms.txt machine-readable file, and installs malware by following official instructions that point to non-existent packages. Security researchers have found hundreds of inadvertent mistakes, and hackers are already leveraging them to trick AI agents into self-compromise. Thousands of companies, including tech giants, fintechs, and defense contractors, already publish llms.txt files on their domains as an emerging convention to provide machine-readable summaries to LLMs and AI agents, similar to robots.txt. Researchers scanned these files and found hundreds of non-existent packages and domains referenced in the documentation.

Demonstrated Attack

Alon Hertz, a security analyst and former member of Unit 8200, said it took 4 minutes for a Fortune 500 company to run code his team wrote. No phishing or intrusion is required to compromise developers who let their AI agents roam; the researchers simply published a code package cited in one of the llms.txt files and achieved code execution inside Fortune 500 companies, according to a report titled "Data Becomes Code." Moreover, they found a live malicious campaign exploiting the same gap, impersonating Clerk by registering a package name referenced in its llms.txt file.

Scale and Discovery

Hertz said his team checked 15,000 major companies and pulled 8,565 llms.txt files across 6,214 live domains. Google instructs developers to place such a file in the site's root directory to save AI time crawling and understanding primary content. This file becomes one of the AI's first interactions with the website, looking for answers on how to use the product, what to read, which APIs to call, which packages to install, and which domains to trust. The researchers found over 237 unclaimed artifacts referenced as installation or setup instructions, including package names, domains, and subdomains.