More than 100 websites are hosting potentially dangerous executable content that downloads and runs automatically when visited by AI agents including Claude and OpenAI's Codex. A few dozen Fortune 500 and startup systems have already executed proof-of-concept code.
The dangerous content resides in llms.txt and llms-full.txt files—an emerging convention websites use to provide machine-readable summaries of site content and structure. They function as an AI equivalent to robots.txt, which instructs search engines on site indexing.
The vulnerability stems from misconfigured files that list non-existent packages from registries such as PyPI and npm, along with installation instructions. An example prompt found was "Installation: pip install [redacted at researchers' request]." Attackers can register these unregistered package names to host ransomware or other malicious software.
Researchers at an Israeli stealth startup scanned 6,214 live domains belonging to defense contractors, Fortune 500 companies, and Big Tech firms. The scan identified 8,265 llms.txt and llms-full.txt files across these domains. Of those files, 120 pointed to code packages or domain names that were not registered.
To test the vulnerability, the researchers registered a handful of unclaimed names and hosted packages designed to send a "phone-home" response upon execution. Within an hour, they received a response from a Fortune 500 company. Over time, they recorded a few dozen additional responses from more Fortune 500 companies and startups.
The beacon also recorded the chain of parent processes that spawned each installation, revealing that Claude, OpenAI's Codex, and Nous Research's Hermes were executing the unowned code.
"The trust model is broken," said Alon Hertz, one of the researchers. "Agents treat vendor docs as ground truth and don't question them—and neither do the humans supervising them." Hertz noted that as AI agents multiply, the supply-chain attack surface grows. Current security controls do not cover this expanded threat vector.
At least one misconfigured site is directing visitors—both human and AI—to live malware. The vulnerability occurs when a coding agent with permission to run shell commands treats the llms.txt file as authoritative setup documentation, triggering automatic package downloads and execution.
Anthropic, OpenAI, and Nous Research did not respond to requests for comment by publication time.
