Unclaimed packages named in llms.txt files let researchers into a Fortune 500: Reveneau

Why it mattersThe attack needed no exploit, no phishing and no network break-in. The companies published the instructions themselves, over HTTPS, and their own agents followed them.

Researchers scanned agent-facing documentation files published by companies and found commands naming software packages that nobody had registered. They registered some of those names. Code then ran inside corporate networks, because the agents did what the companies' own files told them to do.

GBHackers reported the work on 28 August. The original write-up is on Medium by Alon Hertz, and it is linked below. It returns 403 to automated requests, so every figure here comes from GBHackers' coverage rather than from the original post.

The numbers

8,565 llms.txt files were analysed across 6,214 active domains, drawn from around 15,000 organisations. Within those, more than 237 unclaimed artifacts appeared in agent-facing instructions.

Unclaimed means the name was free. Packages on PyPI, npm, RubyGems, NuGet, crates.io and Packagist. Expired domains. Unclaimed deployments on Vercel, Render, Fly and Netlify.

The first installation callback from a Fortune 500 environment arrived in under four minutes. Another followed within the hour.

The concrete example

Documentation for Clerk carried the command npx clerk-next-fix-auth-protection. A package under that name was registered and is tracked as MAL-2026-11069. Its install hooks transmitted the installer's username, hostname, working directory and timestamp to an external server.

That is the whole attack. Someone wrote a helpful command into a documentation file. The package it names was never published, or was published once and abandoned. An agent read the file, treated it as authoritative, and ran it.

Why this is different from a normal typosquat

A typosquat, a fake package whose name is one typo away from a real one, relies on a person mistyping. This relies on a company being correct about its own documentation and an agent being obedient.

The instruction came from the vendor, over HTTPS, from a domain the vendor controls. Every signal a person or an agent would normally use to decide whether to trust a command was present and genuine. The only thing missing was that the package it named had never been created.

Hertz's summary, as quoted in the coverage: agents treat vendor documentation as always correct and do not question it, and neither do the humans supervising them.

What to do this week

The defensive advice is simple and takes an afternoon.

Inventory what your own agent-facing files reference. If you publish an llms.txt, an AGENTS.md, a skill file or a quickstart, list every package, domain and deployment named in it and confirm each one exists and belongs to you.

Reserve the names. A package name you told everyone to install is a name you should own, even if you never publish to it.

Validate command examples in documentation the way you validate code. A command in a docs file is now executable content, because something will execute it without asking.

Then check your own side: whether your agents install packages from documentation without a human seeing the name first.

Source

Researchers Execute Code Inside Fortune 500 Companies via AI Agent llms.txt Files, GBHackers, 28 August 2026. Source of every figure above
Original research: Data Became Code, Alon Hertz, Medium

This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.