AI coding agents are installing untrusted code on corporate networks by processing llms.txt and llms-full.txt files that point to abandoned or unregistered domain names and package repositories. This discovery, made by researchers at a stealth startup in Israel, highlights a critical new supply chain vulnerability that affects a range of high-value targets, including defense contractors, Fortune 500 companies, and Big Tech firms, as detailed by Schneier on Security. The implications of this vulnerability are severe, with parallels drawn to “SolarWinds–style supply chain attacks,” indicating a widespread and difficult-to-detect threat.
Technical Analysis of AI Coding Agent Risks
The research involved scanning 6,214 live domains belonging to defense contractors, Fortune 500, and Big Tech companies. Within the 8,265 llms.txt and llms-full.txt files found, 120 unique instances pointed to one or more unregistered code packages or domain names. To validate the risk, researchers registered a selection of these unclaimed names and hosted benign packages designed to “phone home” upon execution. Within an hour, a callback was received from a Fortune 500 company, followed by dozens more from other Fortune 500 entities and startups.
The analysis of the “phone-home” responses revealed the involvement of various AI coding agents, specifically naming Claude, OpenAI’s Codex, and Nous Research’s Hermes, by tracing the chain of parent processes that initiated the installations. This demonstrates a fundamental breakdown in the trust model, where “agents treat vendor docs as ground truth and don’t question them—and neither do the humans supervising them,” according to researcher Alon Hertz.
This issue stems from the same underlying cause as prompt injection vulnerabilities but presents a broader threat. Unlike prompt injections, where malicious instructions are deliberately planted, this new weakness exploits a scenario where “the instruction itself can be completely benign and come from a legitimate source—a real company’s own documentation—with no malicious actor involved at the time it was written. The danger comes later, when the package or domain it points to is abandoned and someone else claims it.” This illustrates the insidious nature of the attack vector, making it difficult for organizations to anticipate or identify initially. One example, the “Clerk case,” showcased a command that appeared entirely legitimate within a vendor’s instruction file, with the only missing element being the name in the registry. This underlines the challenge in detecting untrusted code installations by AI without explicit checks for domain registration status.
Mitigating AI Coding Agent Risks in Corporate Networks
The proliferation of agentic AI across SaaS, cloud, and endpoint layers significantly expands the supply chain attack surface. Current security guards are inadequate for this new paradigm. Organizations must act decisively to prevent their AI agents from inadvertently introducing untrusted code onto their networks.
Key recommendations for securing corporate networks from AI supply chain attacks include:
- Implement Strict Supervision: Treat all code generated or installed by AI agents with a high degree of suspicion, regardless of its source. Human oversight must verify the integrity and origin of all external dependencies.
- Validate External Dependencies: Develop and enforce policies requiring explicit approval and validation for any external code packages or domains referenced by
llms.txtorllms-full.txtfiles. This includes checking domain registration status and package repository legitimacy. - Monitor Agent Activity: Implement logging and monitoring solutions to track AI agent activities, especially those involving code generation, dependency resolution, and installation. Look for anomalous network connections or attempts to access unregistered domains.
- Address Trust Model Deficiencies: Educate development teams and security personnel on the inherent risks of AI agents treating vendor documentation as unquestionable truth. Establish a framework for continuous verification of third-party references.
- Regular Audits: Conduct regular audits of AI-generated code and the configurations that govern AI agent behavior to identify and remediate potential vulnerabilities introduced through this supply chain vector.
By focusing on these areas, organizations can begin mitigating AI coding agent risks and prevent the installation of unknown or untrusted code that could lead to significant security compromises.
Related: AI Agents Vulnerable to Data Leak via Poisoned MCP Tools, Rogue LLM Endpoints: Data Exposure & RCE Risk for AI Agents