AI coding agents appear to be executing installation instructions from machine-readable corporate documentation with too much trust, according to a detailed Ars Technica report on research from a stealth startup in Israel. The issue centers on llms.txt and llms-full.txt files, an emerging convention that websites use to describe their content and structure for large language models and AI agents. Ars compares the idea to robots.txt for search crawlers: a simple file at a predictable location that tells automated systems how to interpret a site. The risk, as reported, is that some of these files do more than summarize content. They include install instructions that point to packages or domains nobody controls. Ars says the researchers scanned 6,214 live domains associated with defense contractors, Fortune 500 companies, and Big Tech companies. They found 8,265 llms.txt and llms-full.txt files, with many sites hosting both. Of those, 120 files, each on a different site, referred to at least one unregistered code package or domain name. The feed summary says researchers found 227 install commands in corporate documentation pointing at code nobody owns. To test the exposure, the researchers registered some of the unclaimed names and hosted proof-of-concept packages designed to contact their server if executed, Ars reports. Within an hour, they received a callback from a Fortune 500 company. Over time, a few dozen more callbacks arrived, including from additional Fortune 500 companies and startups. The researchers’ beacon also recorded parent-process chains for the installs. Ars reports that those chains showed AI coding agents including Claude, OpenAI’s Codex, and Nous Research’s Hermes were involved. Anthropic, OpenAI, and Nous Research had not responded to Ars’ requests for comment by publication. The failure mode is a familiar software supply-chain problem with an AI-agent twist. If a documentation file says to run a command such as a PyPI or npm install, and the referenced package name is unregistered, an attacker could claim that name and publish malicious code. The vulnerability matters when an AI coding agent has permission to run shell commands and treats the documentation as trusted setup guidance rather than unverified input. Ars also reports that some llms files pointed to nonexistent domain names, creating a related path for abuse if an attacker registered those domains. More sharply, the report says at least one misconfigured site was directing visitors, whether human or AI, to live malware. The cluster does not provide further details on that site or malware. The report is single-source, but the mechanics are concrete: public documentation files, unclaimed package or domain names, automated execution by coding agents, and callbacks from corporate environments. The broader lesson for operators is narrow but important: files designed for AI consumption can become execution pathways if agents are allowed to translate documentation into shell commands without registry, domain, and provenance checks. Who benefits: Security teams and tooling vendors focused on software supply-chain controls, package registry monitoring, and AI-agent sandboxing have a clearer risk case to sell. Organizations that audit llms.txt and llms-full.txt files early can reduce avoidable exposure. Who's exposed: Companies publishing llms.txt or llms-full.txt files with install instructions that reference unregistered packages or domains are directly exposed. Teams allowing coding agents to execute shell commands from documentation without review face the higher operational risk.