Kiran 
Didn’t need a Zero-day, a phishing email, or a foothold on a corporate network to enable code to run across multiple Fortune 500 companies. He just registered software packages that the companies’ own websites were already telling AI agents to install.
The research centers on llms.txt, a plain-text file that thousands of companies now publish at their website root, alongside robots.txt.
Unlike a sitemap, llms.txt is written for machines that act, not just crawlers that index: it tells AI coding agents which docs to read, which APIs to call, and which packages to install to integrate with a company’s product.
OpenAI, Anthropic, and Google all publish their own versions, and Google’s Chrome DevTools now ships a Lighthouse “agentic browsing” audit that actively nudges site owners to add one.
Fortune 500 AI Agents Ran Unclaimed Code Hidden
Hertz’s team resolved 8,565 llms.txt files across 6,214 live domains out of roughly 15,000 companies surveyed. Inside that corpus, they found a recurring flaw: install commands pointing to package names on PyPI, npm, RubyGems, NuGet, crates.io, and Packagist, as well as subdomains on Vercel, Render, Fly, and Netlify that had never actually been claimed by anyone.
Not typosquats. Not misspellings. Exact, correctly spelled names, with the list open for anyone to register first. The team registered a handful of those exact package names and embedded a single inert “phone-home” beacon inside each code that only reported the fact of installation back to infrastructure they controlled, with no persistence and no data theft. Then they waited.
The first callback came in under four minutes. A second Fortune 500 organization checked in within the hour, followed by dozens more callbacks from startups and enterprises alike.
In every case, an AI coding agent had read a company’s official llms.txt, seen an instruction like pip install company-sdk, and executed it, pulling the researchers’ package instead of a legitimate one, because no legitimate one existed.
To test how easily this triggers, the team ran an identical one-line prompt containing nothing but a vendor’s name across five frontier model configurations and two agentic CLIs, 100 times each.
No URL, no mention of llms.txt, no prompt injection, just an instruction to build a project using that vendor’s SDK. Agents repeatedly hunted for the vendor’s llms.txt on their own and installed the unclaimed package because tracking down official documentation is exactly what they’re built to do.
“Data became code, and nobody budgeted for its integrity that’s the whole story here in one sentence,” as one way to frame the shift the researchers describe: content written for humans is now an execution surface for machines, and the security industry hasn’t caught up.
While scanning the corpus, the researchers found an active case already in the wild involving Clerk, an authentication vendor widely used in Next.js applications.
Clerk’s documentation instructs developers to run a bundled CLI tool, clerk-next-fix-auth-protection, packaged inside its scoped @clerk/eslint-plugin.
But when an agent runs that bare command via npx before installing the scoped package locally, npx resolves the name against the public npm registry instead, where Clerk never published it as a standalone package.
The malicious package, tracked as MAL-2026-11069 under CWE-506 and flagged by both OSV.dev and Amazon Inspector, ships no functional code at all: its preinstall and postinstall hooks fire automatically and send the username, hostname, working directory, and timestamp of the installing user to an external server on every install.
Clerk’s security team was notified and addressed the issue quickly; the flaw stemmed from confusion in third-party dependencies, not from Clerk’s own code.
To an EDR tool or corporate proxy, the traffic looks unremarkable: pip install from pypi.org, a domain every enterprise already allowlists, launched by a coding agent the company installed deliberately.
There’s no anomalous parent process and no flagged domain; the failure happens upstream, in the gap between a trusted instruction file and the moment an agent blindly acts on it.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
