14:33Machine-translated from Azerbaijani by AIRead in Azerbaijani
llms.txt Vulnerability Made AI Agents Execute Arbitrary Code
Pandex researchers were able to make AI agents at major companies execute arbitrary code through an llms.txt file. The tests also included agents used by prominent Fortune 500 companies. The llms.txt threat has exposed a new attack vector in the software supply chain. The problem arises because agents directly execute information they read as documentation as though it were an instruction.
An llms.txt file provides brief guidance about a website's product, installation steps, programming language, environment, and dependencies. Instead of analyzing all the documentation, an AI agent can read this file and use fewer tokens. However, if the file contains an outdated package name or a domain that has changed ownership, the agent may treat the malicious source as official guidance and execute the code. The researchers examined 8,565 such files and found 237 package references that no longer existed, were misspelled, had moved, or were outdated. The problems affected the PyPI, npm, RubyGems, NuGet, crates.io, and Packagist ecosystems. The list also included expired domains and unclaimed Render, Vercel, Fly, and Netlify subdomains.
To test the risk, the team developed test Python and Node programs that generated callbacks. The first agent fell into the trap just four minutes after they were published. All it took was an instruction to use all of the vendor's documentation to create and run a Node.js project with the SDK. No filename, link, prompt injection, social engineering, or third-party involvement was required.
More autonomous models were found to follow malicious instructions more often. GPT-5 Luna and GPT-5 Sol executed the code in at least 90% of the tests, while Claude Opus 4.8 did so in 30% of cases in medium-effort mode. During the research, the same method also uncovered one case in which actual malware had already been distributed, and the software vendor was notified. The rapid abandonment of software packages also contributes to the growing risk. An analysis of 13 million packages found that approximately 30% to 60% of packages in the Node.js, Go, and .NET ecosystems had lost development activity two years after release. An outdated llms.txt file retains references to such packages, allowing an attacker to take control of an abandoned name. Having agents separately verify the package name, domain, and documentation could reduce the risk, but this process eliminates the token-saving advantage provided by the file.
An llms.txt file provides brief guidance about a website's product, installation steps, programming language, environment, and dependencies. Instead of analyzing all the documentation, an AI agent can read this file and use fewer tokens. However, if the file contains an outdated package name or a domain that has changed ownership, the agent may treat the malicious source as official guidance and execute the code. The researchers examined 8,565 such files and found 237 package references that no longer existed, were misspelled, had moved, or were outdated. The problems affected the PyPI, npm, RubyGems, NuGet, crates.io, and Packagist ecosystems. The list also included expired domains and unclaimed Render, Vercel, Fly, and Netlify subdomains. To test the risk, the team developed test Python and Node programs that generated callbacks. The first agent fell into the trap just four minutes after they were published. All it took was an instruction to use all of the vendor's documentation to create and run a Node.js project with the SDK. No filename, link, prompt injection, social engineering, or third-party involvement was required. More autonomous models were found to follow malicious instructions more often. GPT-5 Luna and GPT-5 Sol executed the code in at least 90% of the tests, while Claude Opus 4.8 did so in 30% of cases in medium-effort mode. During the research, the same method also uncovered one case in which actual malware had already been distributed, and the software vendor was notified. The rapid abandonment of software packages also contributes to the growing risk. An analysis of 13 million packages found that approximately 30% to 60% of packages in the Node.js, Go, and .NET ecosystems had lost development activity two years after release. An outdated llms.txt file retains references to such packages, allowing an attacker to take control of an abandoned name. Having agents separately verify the package name, domain, and documentation could reduce the risk, but this process eliminates the token-saving advantage provided by the file.