Security researchers at Pandex found a supply-chain weakness in the emerging practice of publishing llms.txt files: Tom’s Hardware reports that instructions written for AI agents can point those agents toward abandoned or nonexistent packages, expired domains, and abandoned hosting subdomains. Tom’s Hardware reports that Pandex used the technique to get code running inside AI agents from unnamed Fortune 500 companies. The issue is not that llms.txt is malicious by design. The file is meant to help AI agents understand a site or software product without crawling full documentation. As Tom’s Hardware describes it, an llms.txt file can summarize what a product does, which language or environment it uses, what dependencies it needs, and how to install or run it. That makes it useful for agents—and risky when those instructions contain stale or unverified references. Pandex’s scan found 237 problematic references across 8,565 llms.txt files, according to the report. The references included packages that no longer exist, names that appear mistyped, packages that have moved, and information that was out of date compared with current documentation. Tom’s Hardware says the affected references spanned package ecosystems including PyPI, npm, RubyGems, NuGet, crates.io, and Packagist, as well as expired or abandoned domains and hosting subdomains. As Tom’s Hardware describes the risk, if an llms.txt file tells an agent to install a package or run an installation command, and that package name or domain is unclaimed, an attacker may be able to register it and wait. An agent following the public instructions could then fetch attacker-controlled code while attempting to build, test, or integrate the vendor’s software. Tom’s Hardware reports that Pandex created proof-of-concept Python and Node code that called back to the researchers. The report says the researchers received a hit four minutes after going live. Pandex also reportedly found one case in which someone had already used the technique with real malware, and notified the software publisher involved. The companies affected were not named in the provided report. That limits what can be stated about scale, impact, and remediation. The credible takeaway is narrower: public agent-facing documentation can become an execution path when agents are allowed to follow setup instructions without sufficient validation. For security teams, the finding is another example of data being operationalized by AI systems. Text that once would have been treated as documentation can now influence build steps, dependency resolution, and code execution. That changes the risk model for public documentation, especially where autonomous or semi-autonomous agents are connected to development environments. Who benefits: Security teams and developer-tooling vendors gain a concrete checklist item: verify agent-facing docs, package names, and domains before agents rely on them. Attackers benefit if organizations let agents follow public setup instructions with broad execution permissions. Who's exposed: Organizations publishing llms.txt files with outdated package or domain references are exposed. Teams using AI agents to build or run code from public documentation are also exposed if those agents lack sandboxing, allow-lists, or dependency verification.