Researchers discovered that misconfigured files on major tech company websites could enable AI agents to install malware. Out of 6,214 sites analyzed, 120 contained llms.txt or llms-full.txt files—guidance files meant to instruct AI models about page content—that included 227 commands like "pip install" and "npm install" pointing to non-existent packages.
The vulnerability stems from a simple but dangerous gap: an attacker could register the names of these non-existent packages and publish malicious code in their place. When an AI agent encounters the install command while processing the misconfigured file, it could unknowingly execute the attacker's payload. This turns poorly maintained configuration files into a direct pathway for code injection.
The risk highlights how AI systems, despite their sophistication, remain vulnerable to basic infrastructure mistakes. As AI agents become more capable of executing actions—not just generating text—securing their input sources becomes critical. These findings underscore the need for organizations to audit and properly maintain guidance files used by AI models.