Security
AI coding agents silently installed malware across Fortune 500 networks via poisoned documentation files
Researchers found that Claude, Codex, and other AI agents automatically executed untrusted code hidden in website documentation files, affecting dozens of major corporations.
Ars Technica
AI agents used by major corporations unknowingly downloaded and executed malicious code from compromised website documentation, researchers have discovered—a critical supply-chain vulnerability affecting dozens of Fortune 500 companies and defense contractors.
The attack surface: llms.txt files#
The vulnerability centers on llms.txt and llms-full.txt files, machine-readable reference documents that websites publish to help AI agents understand their structure and content. Think of them as the AI equivalent of robots.txt, which guides search engine crawlers. These files have become an emerging convention as organizations attempt to standardize how agentic systems access and interpret their websites. Google's Lighthouse now audits proper implementation.
The problem: when these files reference software packages or domains that don't actually exist yet, bad actors can register those unclaimed identifiers and point them toward malicious code. The AI agents then install and execute it without questioning the source.
How the researchers exposed the gap#
Israeli researchers scanned over 6,200 corporate domains from defense contractors, Fortune 500 firms, and major tech companies. They identified 8,265 llms.txt or llms-full.txt files across those sites—and found that 120 of them pointed to code packages and domain names that were never registered.
To test whether real systems would fall for this, the researchers registered a handful of those unclaimed identifiers and hosted test packages that would "phone home" when executed. Within an hour, their server received a callback from a Fortune 500 company. Over time, they logged connections from multiple Fortune 500 firms and startups. Process-level telemetry showed that Claude, OpenAI's Codex, and Nous Research's Hermes were responsible for the installations.
Anthropic, OpenAI, and Nous Research declined to comment at the time of publication.
Why it matters#
As researcher Alon Hertz noted, "The trust model is broken. Agents treat vendor docs as ground truth and don't question them—and neither do the humans supervising them." This highlights a fundamental assumption baked into agentic AI: that official documentation from a website's own domain is inherently trustworthy.
