itpp-infrastructure/docs/security/2026-08-29-llms-txt-supply-chain-advisory.md

# Security Advisory: llms.txt Supply-Chain Prompt Injection

**Date:** 2026-08-29
**Classification:** Security advisory (external research, applies to our agent infrastructure)
**Source:** Ars Technica, Dan Goodin - "Claude, Codex, and Hermes installed unowned code inside corporate networks"
**Severity:** High (for any agent granted shell/package-install permissions)

## Summary

Researchers scanned 6,214 live domains (defense contractors, Fortune 500, Big Tech) and found 8,265 `llms.txt` / `llms-full.txt` files. 120 of those files, each on a different site, pointed at code packages or domain names that were not registered. When the researchers claimed the unclaimed names and hosted phone-home packages, they received callbacks from Fortune 500 companies within an hour, and a few dozen more over time. The parent-process chain implicated three coding agents: Claude, OpenAI Codex, and Nous Research Hermes.

Hermes is the agent platform ITPP runs in production. This is not abstract.

## The Attack Mechanism

`llms.txt` and `llms-full.txt` are an emerging convention: the AI equivalent of `robots.txt`. Websites publish them as machine-readable summaries and setup instructions for AI agents.

The exploit is a supply-chain hijack that works in stages:

1. A legitimate site publishes an `llms.txt` that lists a package or domain that does not exist (or that was later abandoned). The file says, for example, `pip install <name>` or `npm install <name>`.
2. Because the name is unregistered, an attacker registers it and hosts ransomware or any other payload.
3. A coding agent with shell-execution permission reads the file, treats it as authoritative vendor documentation, and downloads and runs the package without checking the namespace, ownership, or whether the domain is still alive.
4. Endpoint detection does not fire. To EDR or a corporate proxy, this is a developer running a legitimate package manager against `pypi.org` or `npmjs.com`, with the agent the company installed on purpose as the parent process.

The researchers found 227 install/view commands across the 120 misconfigured files. Many of the faulty entries predate the AI era (manually written by humans), and some were likely hallucinated by earlier AI.

## Confirmed Live Exploit

At least one active attack is already exploiting this. An `llms.txt` file hosted on `clerk.com` contained:

```
npx clerk-next-fix-auth-protection
```

`npx` fetches a package into the npm cache and executes its binary without adding it to a dependency manifest. Someone claimed the empty slot and hosted live malware. Clerk has since resolved it, and noted that agents that had already installed the `@clerk/eslint-plugin` binary were not at risk, but a fresh agent resolving that name would pull the malicious package.

## How This Differs From Classic Prompt Injection

In a classic prompt injection, someone deliberately plants malicious instructions. Here, the instruction itself is benign and comes from a legitimate source (a real company's own documentation), with no malicious actor at write time. The danger arrives later, when the package or domain the file points to is abandoned and someone else claims it.

The researchers' framing is the key insight: "An agent doesn't distinguish between a page and a command. Everything it reads is input, and every input is a potential instruction." The entire corpus of published data agents now consume has silently become an execution surface.

## ITPP / Hermes Exposure

This is the section that matters for us. Honest assessment:

- **We run Hermes in production**, and it is one of the three agents named in the research.
- Hermes has full shell/terminal execution, web extraction, browser automation, and MCP tool access. The `terminal` tool can run `pip install`, `npm install`, `npx`, and `curl | bash` if instructed to do so.
- The risk is not that Hermes will spontaneously install malware. The risk is that a prompt, a fetched document, or a skill references an unverified package and Hermes executes the install as instructed, with no namespace-ownership check in the loop.

**What we have not yet verified** (flagged as follow-up audit items, not assumed safe):

1. Whether any cron job, skill, or automation reads `llms.txt` / external setup docs and follows install commands.
2. Whether any of our AI products or client deployments run an agent with unguarded shell access against third-party docs.
3. Whether our Super Search / web-extract pipeline surfaces untrusted content into a context where it can drive package installs.

## Mitigations

These are concrete, ordered by impact:

1. **Never auto-install from external docs.** Treat any install command originating from fetched content (web, `llms.txt`, third-party docs) as untrusted until a human or a verification step confirms the namespace.
2. **Verify before install.** For any PyPI/npm package, check ownership, age, maintainer history, and download counts before running. A freshly registered name referenced by a vendor doc is the exact red flag this attack exploits.
3. **Least-privilege on agent shell access.** Do not give agents blanket package-install permissions. Gate `pip` / `npm` / `npx` / `curl | bash` behind confirmation for any agent that consumes untrusted content.
4. **Audit our automation surface.** Enumerate every cron job, skill, and MCP tool that can reach package managers or shell out to install commands. Confirm none follow unverified install instructions.
5. **Detect the gap, not the symptom.** EDR will not catch this because it looks like legitimate developer activity. The control has to live upstream: a guardrail that refuses to execute an install command whose package name cannot be verified to a legitimate, long-standing owner.

## Follow-Up Actions

- [ ] Run the exposure audit in the "ITPP / Hermes Exposure" section (items 1-3 above) and record findings.
- [ ] Add a guardrail or operating rule to Hermes that install commands from untrusted/fetched content require verification.
- [ ] Re-review this advisory if any of our client-facing AI products ship an agent with shell access.

## References

- Ars Technica: https://arstechnica.com/security/2026/08/claude-codex-and-hermes-installed-unowned-code-inside-corporate-networks/
- Researcher post (What Would AI Do): https://whatwouldai.do/
- Researcher write-up (Medium): https://medium.com/@alonhertz1/data-became-code-we-ran-code-inside-fortune-500s-using-files-they-published-for-ai-agents-0cd67ffbbffc
- llms.txt convention: https://llmstxt.org/