llms.txt Dependency Poisoning - Autonomous Agent Self-Compromise
What Happened
On August 31, 2026, security analysts disclosed a novel, widespread attack vector exploiting the newly adopted "llms.txt" web convention. Similar to "robots.txt," the `llms.txt` file is published on corporate domains to provide machine-readable, structured documentation summaries specifically for consumption by AI search engines and coding agents. Security researchers scanned thousands of public `llms.txt` files and discovered hundreds of inadvertent developer mistakes-specifically, documentation referencing non-existent internal software libraries, dead domains, or abandoned package names.
Exploiting this, attackers registered those abandoned package names on public registries like PyPI and npm (a classic dependency confusion attack). When autonomous development and coding agents (such as Claude Code or Cursor) read the poisoned `llms.txt` files to understand a project's architecture or set up environments, they blindly trusted the documentation. The agents autonomously executed commands to install the referenced packages from the public registries, downloading and running the attacker's malware on the developer's local machine or CI/CD pipelines in less than four minutes, leading to silent credential theft and network compromise with no human-in-the-loop validation.
How MEG 1 would have acted
The agent's blind trust in untrusted, machine-readable documentation resulting in autonomous malware installation represents a critical failure of informational safety and input validation, failing the safety boundaries of the Index of Safety and Responsibility (ISR).
MEG 2 Analysis - Legal Framework
Agent level: N2/N3 (management/advanced) - coding and development agents authorized to read web documentation, manage local files, and execute package installer commands (such as pip or npm).
Cause (6.1):
(c) illicit diversion of control (hijacking via documentation poisoning) - the external attacker manipulated the agent's actions by publishing malicious packages matching the dead links in the `llms.txt` file, causing the agent to execute unauthorized commands (hijacking).
(a) system defect - the design defect in the agent's execution model that automatically runs installation and system commands found in unstructured or machine-readable text files without validating the package signatures or registry sources (design defect).
Attachment of liability: The platform manufacturer is liable for the design defect (6.1a) that allowed the agent to execute installers without sandboxing; the deploying organization shares liability if it published an unverified `llms.txt` containing dead references.
Procedural Mechanism
6.2 (architectural human confirmation): This case provides critical validation of Clause 6.2. An agent must be technically blocked from executing third-party installation commands (such as `pip install` or `npm install`) autonomously. Any package download or code execution must require active, architectural human confirmation.
9.4 (least privilege): The execution environment of coding agents must be strictly sandboxed, preventing them from accessing local SSH keys, environment variables, or active credentials during package dependency resolution.
7.1 (independent forensics): Every external file read, package resolution request, and execution command must be securely logged in an unalterable, independent ledger to detect documentation-based poisoning attempts.