What is the risk of AI tools installing suspicious code?
Popular AI coding assistants can automatically read web documentation files like llms.txt to find code snippets or packages to install during software development. When these documentation files reference unregistered or abandoned package names and domains, cybercriminals can claim them and serve malicious code. If AI tools execute commands based on this data, they risk installing malware without human oversight.
Why do unregistered packages and domains appear in documentation?
References to unregistered or outdated packages in documentation can result from human errors, abandoned projects, copy-paste mistakes, or AI hallucinations—where AI generates plausible but false information. These incorrect references become a security vulnerability when AI treats documentation as executable instructions.
Which AI tools have exhibited this behavior?
Research has shown that AI developers such as Claude, OpenAI's Codex, and Hermes have all installed unowned code from misreferenced packages on live corporate networks. This demonstrates that even leading AI coding platforms are vulnerable to this exploitation vector.
How can companies protect their networks?
Immediate mitigation involves auditing and cleaning website documentation to ensure all code references point to legitimate, registered packages and domains. Organizations should consider limiting AI agent permissions, particularly blocking them from executing shell or package manager commands autonomously. Restricting AI from treating documentation as executable code is crucial, although it remains a long-term challenge due to current AI design.
Practical takeaway for cybersecurity professionals
The emergence of "llms.txt"-based attack vectors constitutes a novel form of supply chain and code injection threat amplified by AI automation. Cybersecurity teams must proactively review their public and internal documentation for stale or vulnerable references and implement strict controls around AI agent capabilities. Vigilance today can prevent attackers from hijacking these automated workflows to deploy malware silently inside corporate environments.