AI Agents: The Hidden Danger in llms.txt Files

The new attack surface: when AI trusts too much

The rampant adoption of autonomous artificial intelligence agents has brought an unforeseen consequence: the transformation of web documentation into an entry point for attackers. The recent proliferation of configuration files such as llms.txt and llms-full.txt, originally designed as a modern response to the classic robots.txt to facilitate website reading by large language models (LLMs), has become a critical attack vector. According to recent technical reports, these files are being used to inject unverified code directly into high-security corporate environments.

The fundamental problem lies in the trust architecture of current agents, including Claude (Anthropic), Codex (OpenAI), and Hermes (Nous Research). These systems process the information contained in such files as an "absolute truth." Upon encountering references to software packages, dependencies, or domains, agents often bypass any integrity validation and proceed to attempt their automatic installation or execution. This blind trust turns a simple file read into a potential remote code execution (RCE), breaking the traditional security paradigm where web content was considered passive.

The discovery: a high-risk experiment

Researchers from a cybersecurity startup in Israel conducted a revealing experiment by scanning 6,214 domains belonging to critical sectors: defense contractors, Fortune 500 companies, and tech giants. After analyzing 8,265 llms.txt and llms-full.txt files, they discovered that 120 of these sites contained references to non-existent packages or domains. By strategically registering these "orphaned" domains and hosting proof-of-concept (PoC) packages on them, the researchers were able to receive connection signals (beacons) from internal networks of Fortune 500 companies in less than an hour after the agent's interaction.

As Alon Hertz, one of the lead researchers, points out, "the trust model is broken." The evidence shows that agents do not distinguish between an informative document and an execution command. Everything the agent reads is interpreted as a valid instruction, turning the corpus of data published on the web into a vast execution surface without integrity guarantees. This finding is not just theoretical: at least one misconfigured website detected by the researchers was actively directing visitors, both humans and AI agents, toward functional malware.

Why does this change the cybersecurity landscape?

Historically, the robots.txt file, introduced in the 90s, served solely as a courtesy guide for search engine bots to know which pages to index. The llms.txt standard, while necessary for efficiency in the agent era, has been adopted with a speed that has sidelined security protocols. This transition marks a change of era: we are moving from a web that is "queried" to a web that "executes" processes on behalf of the user.

• Lack of sandboxing: Many agents operate in environments with elevated permissions within corporate infrastructures. When an agent downloads a dependency recommended in an llms.txt file, it often does so with system privileges, allowing a simple read to escalate into a full intrusion.
• Supply chain weakness: Reliance on unverified external sources makes organizations vulnerable to supply chain attacks. If an agent trusts a documentation file that has been compromised or references abandoned repositories, the company imports the vulnerability directly into its core.
• The illusion of automation: Current defense tools are designed to detect malicious traffic based on traditional signatures or network behaviors. However, they are not prepared to audit the internal logic of an agent that, acting under legitimate instructions, decides to "install a recommended library" found in a public document.

This issue is comparable to early remote execution vulnerabilities in web browsers, but with added complexity: the agent acts as an autonomous executor that makes decisions based on ambiguous contexts, eliminating the human oversight barrier that previously existed when clicking a link or downloading a file.

The path forward: toward a zero-trust architecture

For organizations, the lesson is clear: AI agents should not have unrestricted access to web data sources without strict validation and a governance layer. The security community suggests that the deployment of agents must be accompanied by "Zero Trust" policies applied to code execution. This implies that any instruction derived from an external file must be treated as untrusted until it passes through an integrity verification process or is executed in an isolated environment (sandbox) without access to the main network.

It is imperative that agent developers implement human confirmation mechanisms for installation tasks and that companies audit their llms.txt files to ensure they do not reference expired domains or unverified third-party packages. The industry is facing a race against time: as agents become increasingly autonomous, the attack surface grows exponentially, and security must evolve from perimeter protection to protecting the agent's own execution logic.