The Growing Risk of AI-Driven Supply Chain Attacks

Recent studies have uncovered a significant security loophole that allows cybercriminals to leverage AI agents to deliver malicious software. By exploiting incorrect, outdated, or hallucinated instructions found in website documentation, attackers can trick automated systems into executing harmful code.


The Role of llms.txt Files

Modern web development often utilizes specific conventions—namely llms.txt and llms-full.txt files—to help AI agents interpret and navigate website content. When an AI agent attempts to add code to a project, it may scan these documents to find appropriate software packages. However, security researchers have identified that many of these files contain references to domains or packages that are no longer registered or never existed in the first place.


In a comprehensive analysis of over 6,000 live domains, including those belonging to major tech firms, defense contractors, and Fortune 500 companies, experts discovered thousands of these files. Notably, 120 of these domains contained references to unclaimed code packages.


«The vulnerabilities arise from various factors, including human error, abandoned projects, or simple copy-paste mistakes, which are then amplified when AI agents treat this information as authoritative,» the researchers noted.

Proving the Exploit

To test the severity of this issue, the research team registered several of these abandoned package names and hosted benign payloads designed to report back when installed. The results were concerning: within an hour, a major Fortune 500 corporation’s internal system attempted to pull the package, with the number of affected entities rising rapidly shortly thereafter.


This experiment confirms that if security professionals can register these domains, malicious actors can just as easily use them to distribute malware. If an AI agent has the necessary permissions to run package-manager or shell commands, it might inadvertently download and execute malicious code found in these documentation gaps. The report explicitly identified tools such as Claude, OpenAI’s Codex, and Nous Research’s Hermes as being susceptible to these flawed instructions.


Recommendations for Organizations

To mitigate these risks, the research team suggests two primary defensive strategies:

  • Documentation Audits: Companies must actively clean their documentation, ensuring all referenced links and packages are valid, secure, and currently maintained.
  • Restricting Permissions: Organizations should be cautious about granting AI agents the authority to execute commands directly. Treating documentation as a source of truth for executable code is currently a high-risk practice.