Researchers easily trick Fortune-500 companies' AI agents into running arbitrary code — supply-chain attack via llms.txt guidance file illustrates how data has become code

Researchers successfully tricked AI agents from Fortune 500 companies into running arbitrary code through an llms.txt guidance file. This file, often hosted on a software product's website, contains instructions for AI agents on how to correctly scrape a website. The study, conducted by Pandex, discovered 237 references to non-existent or outdated software packages across 8,565 files.

These packages spanned various repositories including PyPI, npm, RubyGems, NuGet, crates.io, and Packagist. When an AI agent encounters the llms.txt file, it immediately knows how to operate the code, including the language, environment, and dependencies. Pandex created their own malware, which was successfully executed by AI agents within four minutes of being deployed.

This highlights the ease with which AI agents can be manipulated using llms.txt files. The researchers concluded that the distinction between data and code is blurring with the rise of agentic LLMs, making it increasingly difficult to distinguish between the two.