120 llms.txt files on scanned domains referenced unregistered domains triggering AI agent installs

Scans of 8,265 llms.txt files across defense, Fortune 500, and Big Tech domains revealed 120 instances directing agents to unclaimed package names or domains. Researchers registered several and observed phone-home events within one hour from production environments, tracing execution chains back to coding agents including Anthropic Claude, OpenAI Codex, and Nous Hermes. At least one misconfigured file served live malware. The pattern matches supply-chain injection vectors previously documented in package registries but now embedded in vendor documentation consumed as authoritative by autonomous agents.

Data shows agents treat llms.txt content as ground truth without domain ownership checks or sandboxing, expanding the attack surface beyond traditional software dependencies. Parent process logs confirmed execution inside corporate networks rather than isolated sandboxes, with responses arriving from both large enterprises and startups. This bypasses existing endpoint detection that focuses on signed binaries or known malicious URLs rather than documentation-driven package resolution.

Operational impact includes loss of control over agent-initiated installs and potential lateral movement once code executes under agent credentials. The trust model failure extends prior observations in LLM prompt injection research where external data sources override safety constraints. Privacy implications arise as agents leak internal process trees and network details to third-party beacons without human review.

Next steps require protocol-level changes such as mandatory domain verification for llms.txt references and agent-side execution gates tied to software bill of materials. Absent updates, the volume of agent-driven installs will scale with adoption, increasing unmonitored entry points across SaaS and cloud layers.