Researchers have shown that the machine‑readable llms.txt and llms-full.txt files, intended as AI‑friendly site indexes, can be weaponised to deliver executable code to large‑language‑model agents. By registering unclaimed domains referenced in these files, the team provoked AI agents such as Claude, OpenAI’s Codex, and Nous Research’s Hermes to download and run code that called home to the researchers’ server, confirming that corporate AI pipelines are already pulling in unowned packages.
What Changed: llms.txt Became an Execution Vector
The scan covered 6,214 live domains belonging to defense contractors, Fortune 500 firms, and major tech companies. Among the 8,265 llms.txt and llms-full.txt files discovered, 120 distinct sites referenced code packages or domains that were not registered. When the researchers registered a subset of those names and hosted benign payloads, AI agents processing the files automatically fetched the payloads and initiated outbound connections.
Why It Matters for AI, Cloud, and Security Engineers
AI‑driven development tools are increasingly integrated into CI/CD pipelines, code review bots, and automated documentation generators. If those tools trust the content of llms.txt files without verification, they can become a supply‑chain entry point for arbitrary code. The fact that a Fortune 500 company’s AI agent reached out within an hour demonstrates a real‑world exposure, not a theoretical risk.
Operational and Security Implications
- Supply‑chain hygiene: Any automated workflow that consumes
llms.txtdata must treat the referenced URLs as untrusted until provenance is verified. - Network monitoring: Unexpected outbound traffic from AI agents or build agents can indicate a rogue fetch triggered by a malicious
llms.txtentry. - Configuration hygiene: Organizations should audit their own
llms.txtandllms-full.txtfiles to ensure they do not point to external or unowned code repositories. - Tooling policies: Teams may need to adjust AI‑agent settings to disable automatic code execution or to require explicit allow‑lists for fetched packages.
Related CloudNinjas coverage: AI engineering.
What This Means For Practitioners
Practitioners should add a verification step before any AI agent consumes a llms.txt file. This can be a simple checksum comparison, a domain allow‑list, or a manual review of referenced packages. Additionally, enable logging of outbound connections from AI‑driven services and set alerts for connections to previously unseen domains. Finally, conduct a sweep of existing llms.txt files across your owned domains to confirm they reference only vetted, owned resources.
