Full Report
We cannot forget that AI coding agents are not yet trustworthy: Researchers at a stealth startup in Israel scanned 6,214 live domains belonging to defense contractors, Fortune 500, and Big Tech companies. Of the 8,265 llms.txt and llms-full.txt files they found (many sites hosted both an llms.txt and an llms-full.txt file), 120 of them, each on a different site, pointed to one or more code packages or domain names that weren’t registered. To test what happens when an AI agent processes such files, the researchers registered a handful of the unclaimed names and hosted packages that caused any machine executing them to reach out to their server. Within an hour, the researchers received a phone-home response from a Fortune 500 company. Over time, they got a few dozen more, some from more Fortune 500 companies and others from startups. Their beacon also recorded the chain of parent processes that spawned each install, ultimately revealing that coding agents, including Claude, OpenAI’s Codex, and Nous Research’s Hermes, were involved. Anthropic, OpenAI, and Nous Research did not respond to requests for comment by the time of publication...
Analysis Summary
# Tool/Technique: AI Coding Agent Supply-Chain Poisoning (via llms.txt)
## Overview
This technique involves poisoning the documentation files (specifically `llms.txt` and `llms-full.txt`) that are used to train or guide AI coding agents. By including references to unregistered code packages or expired domains within these files, an attacker can perform a supply-chain attack. When an AI agent processes the documentation and suggests or executes code based on it, it may trigger the installation of malicious packages from attacker-controlled repositories.
## Technical Details
- **Type:** Technique / Supply Chain Attack
- **Platform:** Cross-platform (any environment utilizing AI coding agents like Python/Node.js environments, Cloud, and SaaS)
- **Capabilities:** Remote Code Execution (RCE), Data Exfiltration (Beaconing), Unauthorized Package Installation.
- **First Seen:** Reported September 2026 (Research conducted by a stealth Israeli startup).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools]
- **[TA0002 - Execution]**
- [T1059 - Command and Scripting Interpreter]
- [T1204.003 - User Execution: Malicious File] (AI Agent as the proxy for execution)
- **[TA0011 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols]
## Functionality
### Core Capabilities
- **Documentation Poisoning:** Leveraging the "ground truth" status of `llms.txt` files to insert malicious dependencies.
- **Dependency Confusion/Hijacking:** Registering unclaimed package names referenced in official corporate documentation.
- **Automated Execution:** Exploiting the autonomous nature of AI agents (Claude, Codex, Hermes) to download and execute code without human verification.
### Advanced Features
- **Context-Aware Triggering:** The attack relies on the AI agent’s specific task (e.g., "Set up this project based on its documentation") to trigger the compromise.
- **Persistence via Development Workflow:** Integrating malicious code directly into the developer's local or CI/CD environment during the initial setup phase.
## Indicators of Compromise
- **File Names:** `llms.txt`, `llms-full.txt` (containing unauthorized external links).
- **Network Indicators:**
- Phone-home beacons to unregistered or newly registered domains/package registries (e.g., `hxxp[:]//[attacker-domain][.]com`).
- Unexpected outbound traffic from development environments to non-standard package repositories.
- **Behavioral Indicators:**
- Parent process chains involving AI agent binaries (e.g., `anthropic-agent`, `codex-engine`, or IDE plugins) spawning package managers like `npm`, `pip`, or `cargo` to install unregistered libraries.
## Associated Threat Actors
- **Independent Researchers:** (Current known activity is limited to white-hat research).
- **Potential:** State-sponsored actors or cybercriminals targeting defense contractors and Fortune 500 companies via supply chain poisoning.
## Detection Methods
- **Signature-based detection:** Scanning `llms.txt` files for links to known malicious domains or unregistered package names.
- **Behavioral detection:** Monitoring for AI agent processes that initiate network connections to fetch external scripts or libraries not present in an internal "allow-list."
- **Audit Logs:** Reviewing package manager logs for the installation of "typosquatted" or recently registered packages immediately following AI agent activity.
## Mitigation Strategies
- **Manual Verification:** Requiring human-in-the-loop (HITL) approval for any package installation suggested by an AI agent.
- **Documentation Sanitization:** Regularly auditing `llms.txt` and `llms-full.txt` files to ensure all referenced domains and packages are owned and valid.
- **Egress Filtering:** Restricting development environments from reaching out to untrusted or newly registered domains.
- **Private Registries:** Utilizing internal package mirrors (like Artifactory or Nexus) to prevent agents from fetching code from the public internet.
## Related Tools/Techniques
- **Dependency Confusion:** The underlying mechanism used once the agent is tricked.
- **Typosquatting:** Often used in conjunction with documentation poisoning.
- **Prompt Injection:** A related field where AI behavior is manipulated via malicious input.