When llms.txt names unregistered packages

Ars Technica reports that researchers scanned 6,214 corporate domains and found 8,265 llms.txt and llms-full.txt files. Files on 120 sites contained 227 commands that referenced unregistered packages or domains. The researchers claimed a few names and published packages that sent a beacon when executed. A Fortune 500 system called back within an hour, and later callbacks identified Claude, Codex, and Hermes in the parent process chain.¹

Failure mechanism

The affected files were legitimate documentation. Some references predated current AI agents, and the package or domain names had never been registered or had lapsed. Claiming a name changed the destination of an existing instruction. Ars also reports that one vendor file referenced an npm name already occupied by live malware; the vendor later removed the reference.¹

Execution required an agent with shell access. The documentation supplied a command, the package registry resolved its target, and the agent ran the result. Endpoint detection could see an approved package manager contacting an approved registry under an approved coding tool, so those signals did not identify ownership of the package name.

BROCS mapping

Build. Documentation consumed by coding agents belongs in the software supply-chain review. Verify package and domain ownership, pin dependencies, and check generated machine-readable files before publication. The Amazon Q incident shows the related risk when executable instructions ship inside an official artifact.

Secure. Restrict the tools available to agents. A lockfile, package allowlist, or approval between download and execution can interrupt this path. The agent controls should apply to instructions retrieved from vendor and project documentation.

Run. Apply outbound network policy to the agent runtime. An egress rule that rejects unapproved destinations can stop a callback even when package installation was allowed. The runtime guidance treats network reach as part of the workload boundary.

Transitive trust

An agent may read documentation from a supplier, partner, or community project. Each source can introduce a package name, domain, or command into the execution path. Review the full chain of references instead of limiting the check to files on the organization's own domain.

brocs.fyi publishes llms.txt and llms-full.txt. They contain definitions and first-party links without install commands or package names. They still need review as input an agent may act on.

The incident is recorded in the failure-mode library. Teams can also check their own machine-readable documentation, verify the ownership of every executable reference, require approval before fetched code runs, and test whether the runtime blocks unapproved egress.