Flawed llms.txt Files Lead AI Coding Agents to Execute Hijacked Packages

Pandex researchers found that stale or invalid package and domain references in vendor-hosted llms.txt and llms-full.txt files can turn AI coding agents into a software supply-chain entry point. Across 8,565 files, they identified 237 references to nonexistent, mistyped, relocated, expired, or outdated packages and domains; a separate review of 120 sites found 227 unsafe instructions. By registering available Python and npm package names and using benign callback proof-of-concept packages, the researchers observed agent-driven installations contacting their infrastructure in as little as four minutes.

The tests implicated agents associated with Claude, OpenAI Codex, and Nous Research Hermes, with more autonomous models showing markedly higher execution rates; GPT-5 Luna and Sol reportedly exceeded 90%, while Claude Opus 4.8 at medium effort executed the test payload roughly 30% of the time. The risk has already been illustrated by Clerk documentation that directed users to install the nonexistent npm package clerk-next-fix-auth-protection; an unknown actor claimed that name and used it to distribute malware. Organizations should treat AI-readable external documentation as untrusted input and require package ownership, namespace, domain, and repository verification before agents run installation commands, since EDR tools may classify npm or PyPI activity as normal development behavior.