Security researchers have uncovered a new class of cyberattack that required no hacking, no phishing, and no exploitation of known vulnerabilities. By scanning thousands of so-called “llms.txt” files, a relatively new type of instruction file that companies publish specifically to guide AI agents, researchers discovered that hundreds of Fortune 500 companies were referencing software package names on registries like PyPI and npm that had never actually been claimed. The researchers simply registered those unclaimed packages themselves, embedded a harmless tracking beacon inside each one, and waited. The first callback from inside a major corporation arrived in under four minutes, with a second Fortune 500 company following within the hour. Across the experiment, dozens of organisations were affected, spanning both startups and enterprises with security teams larger than the entire research group.
What makes this attack particularly confronting is that existing security controls were effectively blind to it. To any endpoint detection system or corporate proxy, the activity looked completely legitimate, as an AI coding agent authorised by the company itself was simply running a standard package manager command against a trusted domain. The llms.txt file was served over HTTPS from the company’s own website in a format purpose-built for AI consumption, making it an authoritative source in the eyes of any agent that encountered it. Researchers also confirmed a live, in-the-wild incident involving Clerk, a widely used authentication vendor whose agent-readable documentation referenced a bare npm package name that had been registered by a malicious third party. That package, catalogued as MAL-2026-11069 and flagged by both Google’s OSV.dev and Amazon Inspector, silently exfiltrated installer details including usernames, machine names and working directories upon every installation.
The researchers argue this incident points to a much broader problem that the security industry has been slow to recognise. For decades, published content like documentation, forums, repositories and emails was considered low-risk because humans consumed it and humans had to choose to act on it. AI agents have changed that entirely, turning published web content into what the researchers describe as operational input, effectively instructions that execute inside someone else’s environment with whatever privileges the agent holds. With over 8,500 llms.txt files resolved across more than 6,200 live domains and 237 unclaimed artefacts identified as potential attack vectors across registries including PyPI, npm, RubyGems and NuGet, the researchers warn that the entire body of data AI agents are wired to consume has quietly become an execution surface, and the security industry has not yet caught up.