Loading story…
Researchers found that more than 100 websites published llms.txt or llms-full.txt files that referenced unregistered package names or domains, creating a software supply-chain exposure for AI agents consuming machine-readable documentation. In a controlled proof of concept, the researchers registered several unclaimed names and received beaconing from automated installations at dozens of organizations, including Fortune 500 companies; telemetry linked activity to Anthropic Claude, OpenAI Codex, and Nous Research Hermes. One misconfigured site also directed users to live malware.
The findings illustrate how attackers can exploit AI agents' reliance on external developer documentation and public package repositories, including by claiming names suggested by model-generated or outdated instructions. This resembles the active Phantom Raven technique of registering hallucinated package names to deliver malicious payloads. Organizations should treat AI-agent development environments as supply-chain trust boundaries, validate package and domain ownership, restrict agent installation and execution rights, and isolate agents and projects through network-layer segmentation and sandboxing.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
The researchers identified at least one misconfigured website whose documentation directed human or AI visitors to live malware.
Parent-process chains captured in the proof-of-concept beacon telemetry indicated that Anthropic Claude, OpenAI Codex, and Nous Research Hermes coding agents were involved in executing content associated with the installations.
Within an hour of hosting the proof-of-concept packages, the researchers received a beacon from a Fortune 500 company. Subsequent telemetry recorded execution from a few dozen organizations, including additional Fortune 500 companies and startups.
The researchers registered several unclaimed package or domain names referenced by the documentation and hosted proof-of-concept packages configured to contact a researcher-controlled server when executed.
Researchers scanned 6,214 domains and identified 8,265 llms.txt or llms-full.txt files. They found 120 files on separate websites that referenced one or more unregistered package or domain names, creating an opportunity to supply content that AI agents could execute.
Threat actors in the active Phantom Raven campaign exploit generative AI tools that hallucinate nonexistent software package names, register those names in public repositories, and seed them with malicious payloads. Developer scripts or AI agents can then automatically retrieve the malicious dependencies into build pipelines.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
arstechnica.com
Open sourcehelpnetsecurity.com
Open sourcellmstxt.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Pandex researchers found that stale or invalid package and domain references in vendor-hosted `llms.txt` and `llms-full.txt` files can turn AI coding agents into a software supply-chain entry point. Across 8,565 files, they identified 237 references to nonexistent, mistyped, relocated, expired, or outdated packages and domains; a separate review of 120 sites found 227 unsafe instructions. By registering available Python and npm package names and using benign callback proof-of-concept packages, the researchers observed agent-driven installations contacting their infrastructure in as little as four minutes. The tests implicated agents associated with Claude, OpenAI Codex, and Nous Research Hermes, with more autonomous models showing markedly higher execution rates; GPT-5 Luna and Sol reportedly exceeded 90%, while Claude Opus 4.8 at medium effort executed the test payload roughly 30% of the time. The risk has already been illustrated by Clerk documentation that directed users to install the nonexistent npm package `clerk-next-fix-auth-protection`; an unknown actor claimed that name and used it to distribute malware. Organizations should treat AI-readable external documentation as untrusted input and require package ownership, namespace, domain, and repository verification before agents run installation commands, since EDR tools may classify npm or PyPI activity as normal development behavior.
Sep 4, 2026
Security researchers reported that the emerging AI agent ecosystem is being abused to distribute malicious tools at scale, with one campaign involving trojanized AI skills reaching **1.7 million installs** in an attack aimed at AI agents. The activity highlights how agents that can autonomously discover and install new capabilities are becoming a new software supply-chain target, particularly where marketplaces, repositories, and MCP servers lack mature vetting and integrity controls. Island said its research found **thousands of malicious repositories** and widespread security flaws across MCP servers, alongside a technique dubbed **"AgentBaiting"** that tricks AI agents into locating and recommending malware to users. The findings underscore a growing enterprise risk in which attackers can poison the AI toolchain itself, forcing organizations to strengthen governance over which agent skills, tools, and external services can be discovered, trusted, and deployed.
Aug 7, 2026
Multiple reports describe threat actors abusing *AI-adjacent* and open-source distribution channels to deliver malware or manipulate automated agents. Straiker STAR Labs reported a **SmartLoader** campaign that trojanized a legitimate-looking **Model Context Protocol (MCP)** server tied to *Oura* by cloning the project, fabricating GitHub credibility (fake forks/contributors), and getting the poisoned server listed in MCP registries; the payload ultimately deployed **StealC** to steal credentials and crypto-wallet data. Separately, researchers observed attackers using trusted platforms and SaaS reputations for delivery and monetization: a fake Android “antivirus” (*TrustBastion*) was hosted via **Hugging Face** repositories to distribute banking/credential-stealing malware, and Trend Micro documented spam/phishing that abused **Atlassian Jira Cloud** email reputation and **Keitaro TDS** redirects to funnel targets (including government/corporate users across multiple language groups) into investment scams and online casinos. In parallel, research highlights emerging risks where **AI agents and AI-enabled workflows become the target or the transport layer**. Check Point demonstrated “**AI as a proxy**,” where web-enabled assistants (e.g., *Grok*, *Microsoft Copilot*) can be coerced into acting as covert **C2 relays**, blending attacker traffic into commonly allowed enterprise destinations, and outlined a trajectory toward prompt-driven, adaptive malware behavior. OpenClaw featured in two distinct security developments: an OpenClaw advisory described a **log-poisoning / indirect prompt-injection** weakness (unsanitized WebSocket headers written to logs that may later be ingested as trusted context), while Hudson Rock reported an infostealer incident that exfiltrated sensitive **OpenClaw configuration artifacts** (e.g., `openclaw.json` tokens, `device.json` keys, and “memory/soul” files), signaling that infostealer operators are beginning to harvest AI-agent identities and automation secrets in addition to browser credentials.
Jun 29, 2026