Researchers easily trick Fortune-500 companies' AI agents into running arbitrary code — supply-chain attack via llms.txt guidance file illustrates how data has become code

Researchers have managed to execute code within an "llms.txt" file that many large companies use to instruct AI agents on how to scrape the website correctly. Back when the internet exploded and search engines became popular, sites started publishing a "robots.txt" file to guide search bots to content. That's still widely used today, but it's now been supplemented with "llms.txt", a file containing textual instructions for AI agents to follow.

The experts from Pandex got their own code to run on AI agents from "companies you have definitely heard of" in the Fortune 500 list, and illustrated yet another way in which the once-sacred distinction between "data" and "code" is all but dead.

The purpose of llms.txt is straightforward: it's often hosted on a software product's website and contains a brief description, setup instructions, and quick installation steps — think of the usual README file, but written for agents. When a bot reaches the website, instead of spending precious tokens and context window space parsing the whole documentation, it reads llms.txt and immediately knows how to operate the code in question: what language it uses, the environment it runs in, any dependencies, and often, precise setup/installation instructions. And that's precisely where the problem lies.