Researchers at a stealth Israeli startup scanned 6,214 live domains belonging to defence contractors, Fortune 500s, and Big Tech companies, looking specifically at llms.txt and llms-full.txt files: the emerging convention by which a site hands AI agents a machine-readable summary of itself, the AI equivalent of robots.txt. Of the 8,265 such files they found, 120, each on a different site, pointed to code packages or domains that were never registered.
So they registered a few. Within an hour, a coding agent inside a Fortune 500 company reached out to their server. Over the following period, a few dozen more did the same, some from further Fortune 500s, some from startups. The beacon recorded the parent process behind every install. It named Claude, OpenAI's Codex, and Nous Research's Hermes.
None of this required a compromised model or a planted instruction. An llms.txt file arrives over HTTPS, on the company's own domain, in a format built specifically for AI consumption. That is its entire purpose: to be read as authoritative. When the file says pip install internal-tool, the agent has no more reason to verify the package's namespace than a human developer would have to verify a colleague's word. In several of the 120 cases, the entries predated the AI era entirely; they were written by humans for humans, migrated into an AI-readable file, and never checked against what still existed in the registry.
The clearest case sat on Clerk's own site: npx clerk-next-fix-auth-protection, sitting in Clerk's documentation, looking exactly like something the vendor would ship. npx fetches straight into cache and runs it without ever touching the project's dependency manifest. Someone had already claimed the slot and used it to host live malware. Clerk has since fixed it; whether it resulted in an actual infection is still unclear.
"The trust model is broken," researcher Alon Hertz wrote in the disclosure. Endpoint detection agreed, in the worst possible sense: to any EDR or proxy watching, this was pip install from pypi.org, a domain every corporate proxy already allows, run by the coding agent the company installed on purpose. No anomaly fired, because nothing about the request pattern was anomalous. The only thing wrong was a name that didn't exist yet.
The reporting treats this as a story about the collapsing line between data and executable code, and it is; an agent that reads a file cannot reliably tell a legitimate instruction from an abandoned one, and that is a real, largely unsolved property of how these systems work. But that framing lets the actual decision-makers off the hook a little too easily.
Before any model read any file, somebody in each of those Fortune 500s decided to give a coding agent permission to run shell commands and install packages against their production or near-production network. That decision is the one this piece is actually about. It is not a question this publication asks rhetorically: did whoever configured that deployment know what their own dependency tree looked like, which internal package names were real, which domains the company still held, which ones had lapsed three renewal cycles ago? Or did they take a vendor's onboarding template, built for a generic engineering org that looks nothing like theirs, and switch it on?
That is not a new failure mode dressed up in AI language. It is the exact shape of question a proper DPIA is supposed to force before a system starts processing anything sensitive: what does this actually touch, what is the realistic blast radius, has anyone here verified the specific environment rather than the category of environment. Cyber Essentials assessors ask a version of the same question about firewall rules and patch cadence. Nobody is yet asking it about agentic tooling with install rights, and the industry's answer when asked is currently "the vendor is reputable," which is precisely the same non-answer this column has already caught standing in for actual endpoint discipline elsewhere this year.
None of this required exotic defence. Deny-by-default execution, an audit log that can't be rewritten after the fact, and a human approval gate between "agent wants to run this" and "this runs" would have stopped every one of the 227 commands in this research cold, because every one of them required a step no policy engine was watching for and no human was asked to confirm. That is not a novel insight; it is the entire design premise behind self-hosted MCP gateways built this year for exactly this reason, this publication's own Airlock among them. The tooling to close this gap predates the research that proved it necessary. What's missing is the DPIA-shaped question that would have told a security team it needed to switch that tooling on before, not after, the phone-home.
None of that starts with buying a gateway, though. It starts with a written constraints document: which registries the organisation actually trusts, which domains it owns and how that list gets kept current, what class of action triggers a human approval and what's allowed to run unattended. That document has to be drafted, reviewed by someone other than the person keen to switch the automation on, and revisited as the environment changes; before the agent gets shell access, not as the action item in the incident report that follows. A deny-by-default gateway only enforces a boundary that's already been defined somewhere; point one at an undefined boundary and it's just a slower way of making the same mistake the vendor's documentation just made for you.
Editor's note: Read alongside this week's companion pieces, "Is Your Company Spoilt for Agents?" and "If You Can't Trust the People Who Built It", both published 27 August 2026. Three angles on the same season: the account nobody's watching, the containment nobody caught, and now the install nobody questioned.
A second editor's note, for the obvious question: this site does not publish an llms.txt or llms-full.txt file, and has no plans to. Haunted Lighthouse runs robots.txt with the named AI crawlers explicitly disallowed, noai/noimageai meta tags on every page, and a copyright and TDM-prohibition notice backed by a liquidated damages clause. The simplest defence against becoming site 121 in someone's research isn't a better-maintained llms.txt. It's not publishing the invitation in the first place.
The Sovereign Auditor covers digital sovereignty, cybersecurity governance, and data protection policy, with particular focus on Isle of Man jurisdiction and Crown Dependency issues.
Payments via PayPal. Credentials delivered by email. No Substack. No Stripe. No middlemen.
