# Coding agents ran install commands they found in llms.txt files

> Researchers found llms.txt files pointing AI coding agents at packages and domains nobody owned, and agents inside large companies installed them in minutes.

Source: https://llmstextgenerator.com/llms-txt-news/llms-txt-supply-chain-attack/
Last updated: 17 October 2026

A researcher registered package names that companies’ llms.txt files told agents to install. Within minutes, an AI coding agent inside a Fortune 500 company had run one.

Happened on 26 August 2026

## What happened?

On 26 August 2026, researcher Alon Hertz published “Data Became Code”, describing what happened when AI coding agents follow the instructions in companies’ llms.txt files.

## What did the research find?

The team scanned about 15,000 companies and resolved 8,565 llms.txt files on 6,214 live domains. In them they found more than 237 things the files told agents to install or use that nobody owned: package names on PyPI, npm, RubyGems, NuGet, crates.io and Packagist, expired domains, and abandoned subdomains on hosting platforms such as Vercel, Render, Fly and Netlify.

They registered a few of those package names on PyPI and npm with a harmless beacon that reports when it is installed. The first callback came from a Fortune 500 company’s machine in under four minutes, a second within the hour, then a few dozen more. In the researcher’s words, “an AI agent read the llms.txt on a company’s website, saw pip install company-sdk, and ran it.”

A separate test gave agents a one-line task naming only a vendor and asked them to build with its SDK. Across five frontier model configurations and two agentic command-line tools, 100 runs each, the agents went looking for llms.txt on their own.

## Was anyone actually attacked?

Yes, once. Clerk’s agent documentation told agents to run `npx clerk-next-fix-auth-protection`, which is a command inside one of Clerk’s packages, not a package of its own. Someone else had registered that bare name with a package that sent the installer’s username, hostname, working directory and a timestamp to an outside server; it is catalogued as MAL-2026-11069. Clerk’s security team, according to the write-up, “responded quickly and addressed it.” Other affected companies were not named while fixes were in progress.

Ars Technica, reporting the next day, named Claude, Codex and Hermes as agents identified from the beacon’s process chain, and said Anthropic, OpenAI and Nous Research had not responded before publication.

## What does it mean for your site?

**Agents may act on what your llms.txt says, not just read it.** Treat every command, package name and domain in the file as an instruction a machine might carry out.

Check that you own and still control each package name and domain it mentions, including names in example commands. Remove examples for products you no longer maintain, and if you document a command that lives inside a package, write the full form so the bare name cannot be taken by someone else. Endpoint security tools are unlikely to notice: to them it looks like an ordinary install.

## Sources

**Source:** [Alon Hertz, “Data Became Code” (Medium)](https://medium.com/@alonhertz1/data-became-code-we-ran-code-inside-fortune-500s-using-files-they-published-for-ai-agents-0cd67ffbbffc)

**Coverage:** [Ars Technica, 27 August 2026](https://arstechnica.com/security/2026/08/claude-codex-and-hermes-installed-unowned-code-inside-corporate-networks/), [Tom’s Hardware, 2 September 2026](https://www.tomshardware.com/tech-industry/artificial-intelligence/researchers-easily-trick-fortune-500-companies-ai-agents-into-running-arbitrary-code-supply-chain-attack-via-llms-txt-guidance-file-illustrates-how-data-has-become-code), [Schneier on Security, 4 September 2026](https://www.schneier.com/blog/archives/2026/09/ai-coding-agents-are-installing-unknown-untrusted-code-on-corporate-networks.html)

[All llms.txt news](https://llmstextgenerator.com/llms-txt-news/)