Cybercriminals could abuse incorrect, outdated, or AI-generated website documentation to trick AI agents into installing malware, according to new research.
The issue involves files called llms.txt and llms-full.txt, which some websites use to make their content easier for AI systems to read.
When an AI coding agent needs to install software or add code to a project, it may search these files for instructions and package names.
Researchers examined 6,214 live domains belonging to defense contractors, Fortune 500 companies, and major technology firms.
Across those sites, they found 8,265 llms.txt-related files.
Among them, 120 websites included references to at least one software package or domain name that was not registered.
These broken references can appear for several reasons, including human mistakes, renamed or abandoned packages, copy-and-paste errors, or hallucinated documentation.
The problem is that someone else can register those missing names.
For the experiment, researchers registered some of the unclaimed names and created harmless packages that simply reported back when someone tried to use them.
Within less than an hour, a Fortune 500 company contacted one of the test packages. A few dozen more systems followed later.
The experiment showed that attackers could potentially register these abandoned or nonexistent package names and replace them with malware.
If an AI agent has permission to run shell commands or package managers, it could follow the bad documentation and install the malicious software automatically.
Researchers said Anthropic’s Claude, OpenAI’s Codex and Nous Research’s Hermes were all vulnerable to this type of behavior during testing.
The researchers say companies should regularly check their documentation and remove references to packages, websites or tools that no longer exist.
AI agents also need to become more cautious about treating documentation as trusted instructions, particularly when those instructions involve downloading or executing software.
Until stronger safeguards are introduced, organizations using AI coding agents should carefully consider how much permission they give those systems to install packages or execute commands.
Get the latest tech news, telecom insights, and product launches wherever you prefer.
Add ProPakistani to Preferred Sources and see more of our stories in Google Search and Top Stories.
Technology and Automotive Specialist covering the latest cars, smartphones, AI breakthroughs, and...
Shares
