AI agents can be tricked into installing malware via unclaimed code packages

An AI assistant that's supposed to help a developer install the right library could instead be quietly tricked into pulling malware into a corporate network. New research suggests that cybercriminals can exploit unclaimed references in AI-readable documentation files to deliver malicious code to unsuspecting victims.

The llms.txt problem

More websites now include two specific files to help AI systems read their content: llms.txt and llms-full.txt. These documents are meant to give AI agents a clean, machine-friendly summary of a site's information. When an AI agent searches for software or code to add to a project, it can look through these files across the web to find a fitting solution.

But the researchers behind this study found that these files sometimes contain references to code packages and domains that no one owns anymore. That's a serious problem, because if an AI agent trusts those references, it might end up running code that was never intended to exist.

Scanning thousands of domains

The team analyzed 6,214 live domains belonging to defense contractors, Fortune 500 organizations, and major technology companies. On those domains, they discovered 8,265 of these .txt files. Among them, 120 (each on a different site) pointed to one or more code packages and domain names that weren't registered at all.

There are several reasons why a package or domain might be unclaimed. It could be due to human error, renamed or abandoned packages, copy/paste mistakes, or even hallucinated documentation that never corresponded to a real resource.

Claiming packages and domains

For the experiment, the researchers registered some of these unclaimed names and hosted packages that would phone home when installed. The results were striking: it took less than an hour for a Fortune 500 company to start pinging, and the numbers soon grew to “a few dozen more.”

This demonstrates that if the researchers can do it, so can cybercriminals. In theory, a cybercriminal could find these unclaimed packages and register malware. If an AI agent has permission to execute shell or package-manager commands and stumbles upon this documentation, it can end up infecting the device.

Popular AI tools called out

The researchers said that several well-known AI tools were “guilty” of falling for this trick. They specifically named Claude, OpenAI's Codex, and Nous Research's Hermes.

This means that even the most popular AI coding assistants are not immune to the problem. The issue isn't just about one tool; it's a systemic vulnerability in how AI agents interact with web documentation.

Fixing the vulnerability

To address this, two things need to happen, according to the researchers. First, companies need to clean up their documentation and make sure it's not pointing towards non-existent or malicious content. Second, AI agents need to stop treating documentation as executable instructions.

Since the latter most likely isn't happening any time soon, the immediate answer would probably lie in the former. In the meantime, organizations using AI for coding should consider the risks when granting AI agents permission to execute commands.

Why this matters for businesses

This research highlights a new vector for supply-chain attacks that could slip past traditional security tools. Even if an organization has robust endpoint protection, an AI agent that trusts malicious documentation could unknowingly install malware.

The risk is particularly acute for large enterprises that heavily rely on AI-assisted coding. A single mistake in documentation could lead to a compromise that goes unnoticed for a long time. As AI agents become more autonomous, the threat of supply-chain attacks through unclaimed packages is likely to increase. Companies that fail to clean up their documentation might unknowingly become part of a malicious chain, enabling attacks on others. The onus is on organizations to be more cautious about how they present information to AI, and on AI developers to build systems that are less trusting of unverified documentation.