Security researchers have demonstrated that AI coding agents can execute unclaimed software packages referenced by trusted-looking website documentation, creating a potential software supply-chain attack path for companies using autonomous coding tools.
The research focused on llms.txt and llms-full.txt, machine-readable files increasingly published by websites to summarize their content and structure for AI systems.
Researchers from the security startup Pandex found that some of those files contain installation commands pointing to package names or domains that are not actually controlled by the organizations publishing the documentation.
The findings were detailed by researcher Alon Hertz in a report titled “Data Became Code: We Ran Code Inside Fortune 500s Using Files They Published for AI Agents”, and were later reported by Ars Technica.
Pandex said it resolved 8,565 llms.txt and llms-full.txt files across 6,214 live domains associated with defense contractors, Fortune 500 companies and major technology firms.
Among the files examined, 120 on separate websites referenced one or more package names or domains that were unregistered.
The researchers identified 227 installation or access commands pointing to those unclaimed resources. The affected package ecosystems included PyPI, npm, NuGet, crates.io, RubyGems and Packagist.
The researchers also found references to expired or unregistered domains and subdomains associated with services including Render, Vercel, Netlify and Fly.
The security problem arises when an AI coding agent treats documentation as an authoritative source of instructions and has permission to execute shell commands.
A file hosted on an organization’s legitimate HTTPS domain can contain an instruction such as pip install followed by a package name. If that package name has never been registered, an attacker can potentially register it and publish their own code under the expected name.
The same principle can apply to an unregistered domain referenced by the documentation. Once an attacker controls the abandoned or unclaimed destination, an agent following the original documentation can be directed to attacker-controlled content.
Unlike conventional typosquatting, the package name does not necessarily have to be misspelled. In the cases investigated by Pandex, the documentation could contain the exact name it was intended to reference, while nobody actually owned that name in the relevant package registry.
To test the risk, the researchers registered a small number of previously unclaimed package names on PyPI and npm.
They did not deploy malware in the experiment. Instead, the packages contained a minimal beacon designed to report when the package had been installed and executed.
The researchers said the first callback from inside a Fortune 500 environment arrived in less than four minutes. Another Fortune 500 callback followed within the first hour, and additional callbacks were received from other enterprises and startups.
The researchers also examined the parent-process information associated with the executions and identified AI coding agents including Anthropic’s Claude, OpenAI’s Codex and Nous Research’s Hermes.
Ars Technica reported that the affected environments included a few dozen companies, with some among the Fortune 500. The research did not establish that the controlled packages caused data theft or a confirmed compromise of those companies.
The experiment instead demonstrated that the agents could reach and execute code that researchers had registered under package names referenced by corporate documentation.
The researchers said the behavior could occur without an attacker placing a malicious instruction directly into the user’s prompt.
In their testing, a simple request to use a vendor’s documentation to build and run a Node.js project was enough for some agents to find the vendor’s documentation and follow installation instructions contained in it.
That creates a chain in which the original documentation can be legitimate, while the resource it references is later claimed by someone else.
The researchers said this can create a security gap because the package manager, domain and AI coding tool can all appear legitimate when viewed separately.
For example, a normal request to install a package from PyPI may not immediately look suspicious to an endpoint or network monitoring system. The agent itself may also be an approved application running with legitimate permissions.
The researchers argue that the failure can therefore occur earlier in the process, when an agent accepts a documentation instruction without verifying who controls the package or domain it references.
A separate case involving authentication provider Clerk showed that the issue is not limited to a controlled experiment.
The researchers found a command in an llms.txt file on the legitimate clerk.com website that read npx clerk-next-fix-auth-protection.
The intended functionality was associated with Clerk’s @clerk/eslint-plugin package. However, the command used a bare package name that could be resolved through the public npm registry when the expected package was not already available locally.
The researchers found that another party had registered the previously unused package name and published malicious code under it.
The package was recorded as MAL-2026-11069. Security records described the package as an impersonator or typosquat and said its installation behavior sent information including the installer’s username, hostname, current working directory and timestamp to an external server.
The package was associated with CWE-506, which covers embedded malicious code, and was also flagged in vulnerability intelligence maintained by OSV.dev and Amazon Inspector.
Clerk was notified and subsequently fixed the documentation issue. It remained unclear whether the confusion resulted in actual infections.
The researchers distinguish this case from their own controlled testing. Their PyPI and npm packages were designed as benign proof-of-concept beacons, while the Clerk package was identified as live malicious software that had been registered by another party.
The findings also broaden the security discussion beyond llms.txt.
Pandex said the same type of risk can arise from other content that AI agents are capable of reading and acting upon, including documentation, README files, support tickets, emails, forums, API responses and other web content.
The central concern is that an autonomous agent can turn information into an action. A human reading a documentation page may see an installation command as something to inspect before running it. An agent with permission to execute commands can potentially treat the same text as an instruction.
The researchers also identified other categories of content that could influence agents, including instructions directed specifically at models, Unicode manipulation and other attempts to alter how an agent interprets text.
The issue has drawn attention from the security community. The SANS Internet Storm Center included the research in its August 28, 2026 security coverage.
Independent research from Ahrefs provides a different piece of context. In a June 2026 analysis of 137,210 domains, Ahrefs found that 28% published an llms.txt file, while 97% of those files received no requests in May. Among the files that were accessed, named AI tools accounted for a portion of the requests, with GPTBot and Claude-Code among the leading identified AI-related user agents. The study did not examine whether the files contained valid or safe instructions.
The findings do not show that every AI system reads llms.txt, or that every organization publishing such a file is exposed. Instead, they demonstrate what can happen when an AI coding agent finds such documentation and has enough permission to execute the commands it contains.
For organizations using coding agents, the researchers’ findings point to several practical controls: auditing AI-facing documentation for unclaimed package names and domains, verifying package ownership before installation, using pinned dependencies and lockfiles, restricting agent permissions, isolating agent execution environments and maintaining human review for software installation from external documentation.
The wider security question raised by the research is whether material traditionally treated as documentation can continue to be considered passive information once autonomous systems are capable of converting that information directly into executable actions.
For more background, Pandex’s research site tracks the categories of exposed package names, domains and agent-directed instructions identified in its work, while Ahrefs’ llms.txt study provides independent data on how these files are actually being accessed across the web.
The researchers have not shown that llms.txt itself is inherently malicious. Their work demonstrates a narrower but significant risk: when AI agents are allowed to execute instructions from trusted documentation, an abandoned or unclaimed dependency referenced by that documentation can become an unexpected route to attacker-controlled code.
Discover more from Aree Blog
Subscribe now to keep reading and get access to the full archive.
