Code Execution via llms.txt in Claude, Codex, and Hermes AI Agents

Security researchers have identified a critical vulnerability allowing Remote Code Execution (RCE) in Anthropic's Claude, OpenAI's Codex, and Nous Research's Hermes AI agents. By exploiting the llms.txt and llms-full.txt standards, attackers employ indirect prompt injection to embed malicious instructions within machine-readable documentation. These agents treat external llms.txt files as high-integrity system instructions rather than passive data, leading to the execution of unauthorized shell commands and API calls. This flaw has been validated via proof-of-concept (PoC) attacks within several Fortune 500 corporate environments, bypassing traditional perimeter security by leveraging the trusted identity of the AI agent to install unowned code.

• Vulnerability Analysis: The llms.txt Execution Surface

  • llms.txt serves as a machine-readable site map intended to optimize LLM navigation and data ingestion.
  • Agents treat these files as "ground truth," failing to distinguish between descriptive metadata and executable system overrides.
  • The vulnerability transforms the public web corpus into an unmanaged supply-chain attack surface for autonomous agentic AI.

• Exploitation Vector: Indirect Prompt Injection

  • Attackers embed system-override strings and malicious payloads within public-facing llms.txt or llms-full.txt files.
  • Execution is triggered when an agent parses a malicious URL during an autonomous research, browsing, or coding workflow.
  • PoC traces demonstrate a direct pipeline from reading a remote documentation file to invoking local shell commands or API calls in the host environment.

• Corporate Impact and Penetration

  • Validated PoC executions confirmed the installation of "unowned code" within multiple Fortune 500 corporate networks.
  • Researchers identified over 100 websites hosting executable content specifically designed to target AI agents.
  • Certain misconfigured sites actively direct both agents and human users to live malware payloads, facilitating lateral movement.

• Affected AI Agents and Capabilities

  • Anthropic Claude: Vulnerable when utilizing autonomous web-browsing and tool-use capabilities to fetch documentation.
  • OpenAI Codex: Susceptible during automated code generation tasks that retrieve external library specifications.
  • Nous Research Hermes: Affected due to high autonomy levels and high trust in external context windows.

• Mitigation and Defense Strategies

  • Implementation of strict output validation and kernel-level sandboxing for all agent-invoked shell or API actions.
  • Deployment of AI-specific guardrails to explicitly treat external web corpora as untrusted, low-integrity data sources.
  • Adoption of secure llms.txt configuration templates and verification schemes to prevent unauthorized instruction injection.