AI 安全
Official llms.txt Files Led Coding Agents to Install Unclaimed Packages, Turning the Documentation Supply Chain Into an Execution Boundary
Pandex found hundreds of installation commands in enterprise AI-facing documentation that referenced unregistered packages or domains. Claude, Codex, and Hermes subsequently executed beacons planted by researchers in real enterprise environments. The issue is not the llms.txt format itself, but agents promoting trusted documentation directly into executable commands while bypassing package ownership and provenance verification.
Pandex Research scanned 6,214 domains belonging to large enterprises, technology companies, and defense suppliers, parsing their `llms.txt` and `llms-full.txt` files. The researchers’ original data states that 8,565 documents contained more than 237 packages, domains, or cloud subdomains available for registration. Ars Technica, meanwhile, reported that across 8,265 documents, 120 websites contained a total of 227 such commands. The two sets of totals have not yet been reconciled through a public dataset or correction, so the exact proportions should not be treated as definitive.
The team registered some of the unclaimed names and deployed beacons that did nothing beyond reporting installation events. The first Fortune 500 environment executed a package within four minutes, followed by dozens of enterprise callbacks. Parent-process chains showed that coding agents including Claude, Codex, and Hermes were involved in the installations. This was not a case of models spontaneously hallucinating package names: the names already appeared in official documentation served over HTTPS, and the agents simply connected “read the installation instructions” to executing `pip`, `npm`, or `npx`.
A real-world example came from Clerk’s documentation. The unqualified command `npx clerk-next-fix-auth-protection` could be intercepted by a package with the same name on the public npm registry; the malicious version exfiltrated the username, hostname, and working directory through an installation lifecycle hook. Clerk has since switched to `npx --package @clerk/eslint-plugin ...`, explicitly identifying the scoped package that provides the binary.
The key engineering takeaway is to treat all external documentation as untrusted data. Before an agent performs an installation, it should verify the namespace, publisher, version, and digest. Package managers should enforce allowlists, while shell access, network access, and persistent write permissions should require separate approvals. Sandboxes and EDR remain valuable, but when an authorized agent proactively downloads software from an approved registry, endpoint detection may see only a normal development workflow. The next question is whether Pandex’s findings can be independently reproduced across different agents, permission models, and success rates once it releases its scanning tools and dataset.