AI Coding Agents Ran Unregistered Packages From Fake Website Instructions, Hitting Fortune 500 Networks

AI coding assistants are running commands from documents nobody vetted, and it's already reached inside Fortune 500 networks. According to Ars Technica, researchers at a stealth Israeli startup found the problem by scanning 6,214 live domains belonging to defense contractors, Big Tech companies, and Fortune 500 firms.

The culprit is a file format called llms.txt, and its longer cousin llms-full.txt. These are meant to work like robots.txt, the old standard that tells search engines how to crawl a website. Except llms.txt files are aimed at AI systems, giving them a machine-readable summary of a site's content and structure. Google's Lighthouse project documents the convention, and Cloudflare publishes examples of a properly configured version.

The researchers found 8,265 of these files across the domains they scanned. Of those, 120 files spread across more than 100 different websites contained installation instructions pointing to code packages that were never actually registered on PyPI, npm, or similar repositories. One file instructed: "Installation: pip install [package name]." Another said: "npm install [package name]." The packages didn't exist. Anyone could grab that name and put anything they wanted behind it.

So the researchers did exactly that, registering a handful of the orphaned package names and standing up a server to catch anything that reached out. According to Ars Technica, they got their first phone-home signal within an hour, from a Fortune 500 company. Over the following stretch, dozens more followed, some from additional Fortune 500 firms and others from smaller startups.

The beacon didn't just confirm installs happened. It recorded the parent processes that triggered each one, and that trail led straight back to AI coding agents, specifically Claude, OpenAI's Codex, and Nous Research's Hermes. Anthropic, OpenAI, and Nous Research did not respond to Ars Technica's requests for comment.

How an AI Agent Gets Tricked This Easily

The mechanism is not exotic. A coding agent given permission to run shell commands treats llms.txt as authoritative setup documentation, the same way a human developer might glance at a README and run whatever install command it lists. The agent doesn't verify the package exists in a legitimate, vetted state. It just runs it.

Alon Hertz, one of the researchers, put it bluntly to Ars Technica: "The trust model is broken. Agents treat vendor docs as ground truth and don't question them, and neither do the humans supervising them." Hertz added that as agentic AI spreads across SaaS platforms, cloud infrastructure, and endpoints, the attack surface grows with it, and that "today's guards don't cover it."

This isn't a hypothetical either. According to Ars Technica, at least one misconfigured site was actively directing visitors, human or AI, to live malware. That's not a proof-of-concept. That's a real infection vector sitting on a real website, right now, waiting for the next agent to crawl it.

Nobody Broke In. They Were Let In.

There's no evidence any of these companies were breached through sophisticated hacking. The researchers didn't exploit a software vulnerability in Claude, Codex, or Hermes. They registered a package name that should have belonged to someone, and AI agents installed it because a text file told them to.

Companies are handing AI agents shell access and trusting them to filter good instructions from bad, and the agents aren't doing that filtering. Worse, the humans running these systems apparently aren't checking either, since researchers were able to collect confirmed installs from dozens of organizations over time without anyone flagging it publicly before this research surfaced.

This is a supply-chain problem dressed up as an AI problem. The open-source software world has dealt with typosquatting and dependency confusion attacks for years, where bad actors register package names similar to legitimate ones and wait for a developer to make a typo. AI agents don't make typos. They follow instructions from unverified documentation with the same blind trust a rushed junior developer might extend to a shady README.

What Happens Next

Ars Technica reports the researchers redacted the specific package names in their writeup at their own request, meaning the exact vulnerable packages aren't public yet, presumably to avoid handing a roadmap to bad actors before companies patch. But the underlying llms.txt files on the more than 100 flagged sites remain misconfigured as of this reporting, unless the site owners have separately caught and fixed them.

No company has been named. No regulator has announced an investigation. This was a research exercise, not a law enforcement action, and there's no indication yet that any of the affected Fortune 500 companies have publicly acknowledged the finding or changed how their coding agents handle third-party documentation. The open question is whether AI vendors like Anthropic and OpenAI will build in verification steps before agents execute install commands from arbitrary web content, or whether that burden falls entirely on the companies deploying these agents with shell access turned on.