AI coding agents installed unknown code inside corporate networks through a flaw in a little-known web standard
Researchers set a trap in files that AI agents read automatically. Dozens of companies, some of them Fortune 500s, walked right into it.
Key points
- Researchers scanning 6,214 domains found 120 websites whose AI-readable guide files pointed to software packages that nobody owned.
- Within one hour of registering one unclaimed package name, the researchers received a connection from a Fortune 500 company's internal network.
- AI coding agents including Claude (Anthropic) and Codex (OpenAI) were identified in the chain of events that triggered the installs, along with Nous Research's Hermes.
- At least one misconfigured site is actively serving real malware, not just proof-of-concept code.
- Anthropic, OpenAI, and Nous Research had not responded to requests for comment before publication.
A small Israeli security startup has exposed a vulnerability hiding inside a web standard most people have never heard of. Dozens of companies, including some of the largest in the world, have already been caught by it.
What is the problem, exactly?
The issue lives in files called llms.txt and llms-full.txt. Think of them as a cheat sheet a website leaves out for AI software: a plain-text summary of what the site contains and how it's organised. They work the way robots.txt does for Google, telling search engines which pages to crawl. These newer files tell AI agents, software that can carry out multi-step tasks on its own, what the site is about and, critically, what software it uses.
The problem is what happens when that cheat sheet contains a mistake.
How did the attack work?
Researchers scanned 6,214 live domains belonging to defence contractors and large technology companies. Among the 8,265 llms.txt and llms-full.txt files they found, 120 of them, each on a separate site, named software packages or web addresses that no one had registered. Dead references.
The researchers claimed a handful of those unclaimed names and placed harmless beacon code on them, software that phones home when executed, to measure who connected.
Within an hour, a Fortune 500 company called in.
Over the following days, a few dozen more responses arrived. The researchers could see which software had kicked off each process. Coding agents, AI tools that help developers write and run code automatically, were responsible: Claude, Codex, Hermes. Each had read the guide file, found the software reference, and fetched it without any human pressing a button. We covered these agents in a different context when Slack gave them their own project channels on 20 August, and the autonomy that makes them useful there is precisely what makes this attack cheap to run.
Ars Technica, which first reported the full technical details, noted that at least one real-world site is serving live malware, not harmless test code.
What does this mean for ordinary people?
If your company uses AI coding tools, software that autocompletes code or runs tasks in the background, your internal network may have already fetched code from a source nobody vetted. You didn't need to click anything. Neither did your colleagues.
The immediate practical step: developers and security teams should audit their llms.txt files and confirm that every package name listed is one their organisation actually controls.
Broader fixes depend on the companies building these agents. Until coding agents verify that referenced packages are real and trusted before fetching them, this class of attack stays cheap to run and hard to spot. That's the part worth watching here. The vulnerability itself is almost trivially simple, and the industry's response, or lack of one, will say a lot.
Common questions
Does this affect me if I do not use AI tools at work?
Not directly. The risk sits with organisations running AI coding agents that process these files automatically. Standard web browsing doesn't trigger the same behaviour.
Should companies stop using AI coding agents?
Not necessarily, but security teams should know which agents are running in their environment, what permissions those agents hold, and whether their own websites carry verified llms.txt files.
