AI Agents Are Installing Malware From Your Own Website
Read the Portuguese translation →
Author: Better Stack · Watch on YouTube
Video authored by the channel shown, not by IANIA; all rights belong to the creator. Transcript and summary generated automatically; the original-language content is preserved.
Original language: English
Original video: AI Agents Are Installing Malware From Your Own Website · Channel: Better Stack · 02:06 · Watch on YouTube
Topics: AI agents, Cybersecurity and software security, AI safety
Summary
Section titled “Summary”A security researcher found unregistered package names, domains, and install commands referenced in publicly available llms.text files across major company websites. After registering some of those names, he observed companies—including a Fortune 500 company—running code that sent signals to his server, with AI coding agents among the processes involved. The video warns that agents may execute instructions from trusted-looking documentation without verifying package names, and reports that one file referenced a live malware package. Recommended safeguards include preventing agents from blindly running install commands, pinning reviewed dependency versions, and treating these files as untrusted until a human checks them.
Key points
Section titled “Key points”- llms.text and llms-full.text files provide machine-readable summaries intended to help AI agents understand websites.
- Allan Hurst scanned more than 6,000 domains belonging to defense contractors, Fortune 500 companies, and big tech companies.
- The scan found more than 8,000 llm.text files, including references to unregistered package names and domains.
- Hurst registered some unclaimed names and configured them to send a message to a server he controlled when installed or run.
- A Fortune 500 company ran his code within four minutes, and dozens more companies followed over the next few days.
- The parent process chains included coding agents such as Claude, Codex, and Hermes.
- The video says one misconfigured file referenced a live malware package.
- The suggested defenses are to prevent blind execution of install commands, pin dependencies to reviewed versions, and treat llms.text files as untrusted input until a human reviews them.
Chapters
Section titled “Chapters”| Start | Chapter | Summary |
|---|---|---|
| 00:00 | The role of llms.text files | The video introduces llms.text files as machine-readable website summaries and describes a scan of company domains. |
| 00:30 | Testing unclaimed package names | Hurst finds unregistered names and install commands, then registers some names to track code that uses them. |
| 01:03 | Agents execute unreviewed code | Companies run the code, and process logs identify coding agents among the triggers; one file also contains a live malware package. |
| 01:35 | Reducing the risk | The video explains why agents may trust install instructions in documentation and recommends human review and dependency pinning. |
Quotes
Section titled “Quotes”Think of it as the AI equivalent of robots.txt. — 00:00
there were also 227 install commands pointing at names that just didn’t exist — 00:30
And it took just 4 minutes for a Fortune 500 company to run the code he had written. — 01:03
they just see an install command in a trusted-looking file and execute it — 01:35
treat every LLMs.txt file, even ones from vendors you trust, as untrusted input until a human has looked at it. — 02:06
Concepts and entities
Section titled “Concepts and entities”llms.text, llms-full.text, Allan Hurst, Claude, Codex, Hermes, Better Stack
Full transcript (original language)
Section titled “Full transcript (original language)”00:00 Did you know that AI coding agents are quietly sending signals back to attacker controlled servers from inside Fortune 500 networks right now? Researchers just proved it, and it comes down to one file that most companies don’t even realize they have exposed online. Let me explain. So, there’s this emerging convention where everyone is using files called llms.text and llms-full.text. Think of it as the AI equivalent of robots.txt. It’s a machine-readable summary websites publish so AI agents can understand the site faster. A security researcher named Allan Hurst did a scan of over 6,000 domains
00:30 belonging to defense contractors, Fortune 500 companies, and big tech companies. And he found more than 8,000 of these llm.text files. And buried inside 120 of them on 120 different sites were references to code packages and domains that nobody had actually registered. And there were also 227 install commands pointing at names that just didn’t exist, so they were most likely hallucinated by AI agents. So, Hurst ran an experiment. He registered a handful of those unclaimed package names and domains himself and set them up so that anything installing or running that code would automatically send a message
01:03 back to the server he controlled. And it took just 4 minutes for a Fortune 500 company to run the code he had written. And over the following days, dozens more companies rolled in. And because he logged the parent process chain for every install, he could see exactly what triggered it. And amongst them were coding agents like Claude, Codex, and Hermes. And all of them were quietly executing code that no human at those companies ever reviewed or approved. And he even found that in one of those misconfigured files, there was a live malware package. So, this is a real supply out in the open that can be triggered if an AI agent simply follows the instructions sitting right there in
01:35 a company’s own documentation. And the problem is that these agents don’t have a way to check whether the package name is legitimate before they run it. They just see an install command in a trusted-looking file and execute it the same way they would trust any other instruction. So, the vulnerability isn’t really in Claude or Codex or Hermes individually, it is in the fact that nobody’s verifying the destination before the the executes. So, what can you actually do about this? Well, if you’re running coding agents anywhere near real infrastructure, don’t let them blindly execute install commands straight out of documentation. And don’t forget to pin your dependencies to
02:06 versions you’ve actually reviewed, and treat every LLMs.txt file, even ones from vendors you trust, as untrusted input until a human has looked at it. And if you want to stay up to date with the latest in AI security and engineering, be sure to subscribe to the Better Stack channel.