AI coding agents installed unknown code inside corporate networks through a flaw in a little-known web standard

Key points

• Researchers scanning 6,214 domains found 120 websites whose AI-readable guide files pointed to software packages that nobody owned.
• Within one hour of registering one unclaimed package name, the researchers received a connection from a Fortune 500 company's internal network.
• AI coding agents including Anthropic's Claude, OpenAI's Codex, and Nous Research's Hermes were identified in the chain of events that triggered the installs.
• At least one misconfigured site is actively serving real malware, not just proof-of-concept code.
• Anthropic, OpenAI, and Nous Research had not responded to requests for comment before publication.

A small Israeli security startup has exposed a quiet but serious vulnerability hiding inside a web standard most people have never heard of, and dozens of companies, including some of the largest in the world, have already been caught by it.

What is the problem, exactly?

The issue lives in files called llms.txt and llms-full.txt. Think of them as a cheat sheet a website leaves out for AI software: a plain-text summary of what the site contains and how it is organised. They work the same way robots.txt does for Google, telling the search engine which pages to crawl. These newer files tell AI agents, software that can carry out multi-step tasks on its own, what the site is about and, critically, what software it uses.

The problem is what happens when that cheat sheet contains a mistake.

How did the attack work?

Researchers scanned 6,214 live domains belonging to defence contractors, Fortune 500 firms, and large technology companies. Among the 8,265 llms.txt and llms-full.txt files they found, 120 of them, each on a separate site, named software packages or web addresses that no one had actually registered. They were dead references.

The researchers registered a handful of those unclaimed names themselves and placed harmless beacon code on them, software that simply phones home when executed, so they could measure who connected.

Within an hour, a Fortune 500 company called in.

Over the following days, a few dozen more responses arrived. The researchers could see, in each case, which software had kicked off the process. Coding agents, AI tools that help developers write and run code automatically, were responsible. Claude, made by Anthropic. Codex, made by OpenAI. Hermes, made by Nous Research. Each had read the guide file, found the software reference, and tried to fetch and run it without any human pressing a button.

Ars Technica, which first reported the full technical details, noted that at least one real-world site is not serving harmless test code. It is serving live malware.

What does this mean for ordinary people?

If you work at a company that uses AI coding tools, software that autocompletes code or runs tasks in the background, your internal network may already have fetched and run code from a source nobody vetted. You did not need to click anything. Neither did your colleagues.

The immediate practical step is for developers and security teams to audit their own llms.txt files and confirm that every package name and web address listed is one their organisation actually controls.

Broader fixes depend on the companies building these agents. Until coding agents verify that referenced packages exist and are trusted before fetching them, this class of attack remains cheap to run and hard to spot.

Common questions

Does this affect me if I do not use AI tools at work?

Not directly. The risk sits with organisations running AI coding agents that process these files automatically. Standard web browsing does not trigger the same behaviour.

Should companies stop using AI coding agents?

Not necessarily, but security teams should know which agents are running in their environment, what permissions those agents have, and whether their own websites carry verified, up-to-date llms.txt files.