#llmstxt
-
AI Agents Are Installing Unregistered Code on Corporate Networks
Researchers have shown that AI agents blindly trust llms.txt files and pull in packages via links to unclaimed domains — fertile ground for supply-chain attacks.
-
AI agents installed “unowned” code inside corporate networks because of llms.txt files
Researchers in Israel found 227 commands across the documentation of more than a hundred sites that install packages and domains owned by no one. Coding agents like Claude, Codex and Hermes dutifully ran them — including inside Fortune 500 companies.