Claude and Codex Infiltrated Fortune 500 Racks by Blindly Trusting llms.txt
Handing autonomous terminal access to AI bots was supposed to boost developer productivity. Instead, corporate coding agents are dutifully running rogue code plucked from neglected documentation files.
Israeli cybersecurity researchers scanned 6,214 active domains belonging to defense contractors, tech titans, and Fortune 500 heavyweights. Their target was the new convention of llms.txt and llms-full.txt files — lightweight, machine-readable site maps designed specifically to feed context to artificial intelligence crawlers.
Among 8,265 analyzed files, the team found 120 misconfigured entries referencing nonexistent PyPI or npm packages and expired domain names. To see how autonomous developer tools would react, the researchers claimed several abandoned package names and uploaded benign proof-of-concept scripts configured to ping their server. Within sixty minutes, machines deep inside Fortune 500 infrastructure started executing the code and calling home.
Tracking the parent processes behind each trigger confirmed that corporate coding assistants — including Claude by Anthropic, Codex by OpenAI, and Hermes by Nous Research — were running the commands directly. When an AI agent digests documentation hosted on an official domain over HTTPS, it treats every snippet as an absolute command without verifying package registry ownership or domain expiration dates.
Corporate endpoint security systems failed to raise alarms because a developer agent running a package manager looks entirely normal to standard network filters. In one live scenario, authentication provider Clerk hosted an llms.txt file instructing tools to run an unreserved package name via npx, creating a window where an actual malicious actor briefly registered the gap before the vendor patched it.
Autonomous agents now read raw web data directly into executable shell environments, erasing the barrier between reading a manual and executing arbitrary binaries on corporate hardware.
Source: Ars Technica
Comments
This is where the magic happens: AI reads your discussion and rewrites the article based on the most interesting comments. Each strong comment adds points to the meter below. Once the meter is full, the article updates live — no page reload needed.