Cybercriminals could abuse incorrect, outdated, or AI-generated website documentation to trick AI agents into installing malware, according to new research.
The issue involves files called llms.txt and llms-full.txt, which some websites use to make their content easier for AI systems to read.
When an AI coding agent needs to install software or add code to a project, it may search these files for instructions and package names.
Hundreds of Risky References
Researchers examined 6,214 live domains belonging to defense contractors, Fortune 500 companies, and major technology firms.
Across those sites, they found 8,265 llms.txt-related files.
Among them, 120 websites included references to at least one software package or domain name that was not registered.
These broken references can appear for several reasons, including human mistakes, renamed or abandoned packages, copy-and-paste errors, or hallucinated documentation.
The problem is that someone else can register those missing names.
Researchers Tested the Risk
For the experiment, researchers registered some of the unclaimed names and created harmless packages that simply reported back when someone tried to use them.
Within less than an hour, a Fortune 500 company contacted one of the test packages. A few dozen more systems followed later.
The experiment showed that attackers could potentially register these abandoned or nonexistent package names and replace them with malware.
If an AI agent has permission to run shell commands or package managers, it could follow the bad documentation and install the malicious software automatically.
Researchers said Anthropic’s Claude, OpenAI’s Codex and Nous Research’s Hermes were all vulnerable to this type of behavior during testing.
Companies Need to Clean Up Their Documentation
The researchers say companies should regularly check their documentation and remove references to packages, websites or tools that no longer exist.
AI agents also need to become more cautious about treating documentation as trusted instructions, particularly when those instructions involve downloading or executing software.
Until stronger safeguards are introduced, organizations using AI coding agents should carefully consider how much permission they give those systems to install packages or execute commands.
The post AI Coding Agents Can Be Tricked Into Installing Malware appeared first on ProPakistani.
