Supply-Chain RCE via llms.txt Guidance Files in AI Coding Agents

Security researchers have demonstrated a critical vulnerability where autonomous AI coding agents can be manipulated into executing arbitrary code via Indirect Prompt Injection. By poisoning llms.txt guidance files—standardized documentation intended for LLM consumption—attackers can embed malicious instructions that agents interpret as legitimate system commands. In tested environments, researchers compromised Fortune 500 AI agent implementations in under one hour. The attack leverages the agent's shell access to execute Remote Code Execution (RCE) payloads hosted in malicious Git repositories or embedded directly within markdown, effectively transforming static documentation into an executable supply-chain attack vector.

• Threat Model & Vulnerability Overview

  • Exploitation of the "trust boundary" between autonomous AI agents and external documentation sources.
  • Transformation of static data (llms.txt) into executable instructions through Indirect Prompt Injection.
  • Targeting of AI agents equipped with shell access, enabling direct interaction with the underlying host system.

• Attack Mechanics & Exploitation Vector

  • Delivery: Attackers place poisoned instructions within llms.txt files on public-facing websites or Git repositories.
  • Execution: AI agents fetching these files for context interpret the embedded instructions as high-priority system prompts.
  • Payload: Malicious strings trigger the agent to run arbitrary shell commands or pull malicious code from external sources.

• Systemic & Security Impact

  • Critical Severity: Successful exploitation leads to full Remote Code Execution (RCE) within the agent's environment.
  • High Velocity: Time-to-compromise is estimated at under one hour, indicating a low barrier to entry for attackers.
  • Supply-Chain Risk: Establishes a new vector where trust in third-party documentation results in immediate system compromise.

• Countermeasures & AI Alignment

  • Environment Isolation: Implementation of strict sandboxing and ephemeral containers for all AI agent shell operations.
  • Human-in-the-Loop (HITL): Mandatory manual approval for any command execution triggered by externally sourced data.
  • Input Validation: Robust filtering and sanitization of instructions fetched from guidance files to prevent command injection.

• Conclusion

  • The shift toward "documentation-as-code" requires a fundamental change in how security professionals perceive static text files.
  • AI framework developers must prioritize the enforcement of trust boundaries to prevent agents from blindly executing external guidance.