Researchers easily trick Fortune-500 companies' AI agents into running arbitrary code — supply-chain attack via llms.txt guidance file illustrates how data has become code
- ID
- 20629
- Status
- summarized
- Published
- 02 Sep 2026, 6:20 PM
- Fetched
- 02 Sep 2026, 8:11 PM
- Provider
- Tom's Hardware
- Category
- technology
- Original URL
- https://www.tomshardware.com/tech-industry/artificial-intelligence/researchers-easily-trick-fortune-500-companies-ai-agents-into-running-arbitrary-code-supply-chain-attack-via-llms-txt-guidance-file-illustrates-how-data-has-become-code
- Source URL
- https://www.tomshardware.com/feeds/all
Summary
- Score
- 8.0
- Created
- 02 Sep 2026, 8:12 PM
- Tags
- Audience
- developersai_agent_usersai_ml_learners
What happened
Researchers from Pandex demonstrated a supply-chain attack where they embedded arbitrary code inside llms.txt files—a new convention analogous to robots.txt that websites use to instruct AI agents on how to scrape and interact with their content. They successfully got their code executed by AI agents from Fortune 500 companies, illustrating that the boundary between data and code has effectively collapsed for agent-based systems.
Why it matters
If you build or deploy AI agents that consume llms.txt or similar instruction files from third-party sites, treat those files as untrusted executable code, not passive metadata. Any agent that reads and acts on llms.txt without sandboxing or input validation is vulnerable to arbitrary code execution from a remote, attacker-controlled source. Audit your agent's file-fetching and instruction-parsing pipeline now.
Discussion angle
The llms.txt convention is still emerging—if your team is adopting it, what guardrails should you put in place before pointing agents at arbitrary sites? Compare this to the early days of robots.txt and what lessons from that era apply now.