AI Coding Agents Installed Unclaimed Packages Referenced in llms.txt Files

Researchers found that more than 100 websites published llms.txt or llms-full.txt files that referenced unregistered package names or domains, creating a software supply-chain exposure for AI agents consuming machine-readable documentation. In a controlled proof of concept, the researchers registered several unclaimed names and received beaconing from automated installations at dozens of organizations, including Fortune 500 companies; telemetry linked activity to Anthropic Claude, OpenAI Codex, and Nous Research Hermes. One misconfigured site also directed users to live malware.

The findings illustrate how attackers can exploit AI agents' reliance on external developer documentation and public package repositories, including by claiming names suggested by model-generated or outdated instructions. This resembles the active Phantom Raven technique of registering hallucinated package names to deliver malicious payloads. Organizations should treat AI-agent development environments as supply-chain trust boundaries, validate package and domain ownership, restrict agent installation and execution rights, and isolate agents and projects through network-layer segmentation and sandboxing.