A file called llms.txt is quietly becoming standard on company websites. It works like a cheat sheet for AI: instead of making a chatbot or coding tool crawl an entire site to figure out what it offers, the site owner writes a short summary and drops it in a fixed location, similar to how robots.txt has told search engines what to index for three decades. Some versions, called llms-full.txt, dump the entire site's text in one file.
The problem shows up when these files also list software packages or web addresses for AI coding tools to fetch and run. Security researchers scanned more than 6,000 company websites, including defense contractors, Fortune 500 firms, and big tech names, and found over 8,000 of these guide files. On 120 different sites, the files pointed to packages or domains that nobody had actually registered.
That gap is the entire attack. Anyone can register the missing name for a few dollars, load it with malicious code, and wait. An AI coding agent that reads the file will treat the reference as legitimate, fetch it, and run it automatically, with no person ever clicking a link or approving an install.
To prove the point, the researchers registered a handful of the missing names themselves and set up a simple trap: any machine that ran the package would quietly report back to their server. Within an hour, a Fortune 500 company's network checked in.
Over the following days, dozens more followed, some from other large companies and some from smaller startups. Tracing the chain of programs that triggered each install pointed straight back to well known AI coding assistants, including Claude, OpenAI's Codex, and Nous Research's Hermes.
This fits a pattern security researchers have been flagging since early last year, often called slopsquatting. Earlier academic research found that AI tools regularly invent software package names that sound plausible but do not exist, and attackers have started registering those exact names in advance, betting that a developer or an AI agent will eventually try to install one. The llms.txt problem is the same trick with a twist: instead of waiting for an AI to hallucinate a name in a chat window, the fake reference is planted directly inside a company's own documentation, where an AI agent is designed to trust it completely.
Adoption of llms.txt is still low, well under one in ten among large companies by most counts, which means this is not yet a mass event. But that is exactly why it deserves attention now rather than later. The companies most likely to get burned are the ones moving fastest, letting AI coding agents browse documentation and pull in packages with little or no human checking each step.
The fix is not complicated, even if it is not glamorous. Any file meant to be read by an AI agent should be treated as untrusted content, the same way a company would treat an email attachment or a random webpage, not as trusted internal documentation.
Firms that already let coding agents install packages on their own should also limit what those agents can reach on the open internet, so that even a bad install cannot phone home to an attacker. The uncomfortable lesson here is that the weak point was never the AI models themselves. It was the assumption that anything written down for a machine to read is automatically safe for that machine to act on.