Researchers trick Fortune 500 AI agents via poisoned llms.txt files

Researchers demonstrated a supply-chain attack that manipulates AI agents deployed at Fortune 500 companies into executing arbitrary code, by embedding malicious instructions in public llms.txt guidance files the agents are meant to trust. The attack works because agents treat that external text as instructions rather than untrusted data.

Why it matters: llms.txt files were created to help AI crawlers and agents understand a site's content, but this shows they can double as an unauthenticated instruction channel, a textbook prompt-injection vector at enterprise scale. It's another instance of the recurring 'data becomes code' problem in agentic AI security, and adds pressure on agent builders to sandbox and validate any external content before letting it influence agent actions.