“The trust model is broken,” Alon Hertz, one of the researchers, wrote in an interview. “Agents treat vendor docs as ground truth and don’t question themand neither do the humans supervising them. Agentic AI usage is exploding, and agents are spreading across every layerSaaS, cloud, endpoint. As they multiply, so does the supply-chain surface, and today’s guards don’t cover it.”
Wide scan of corporate domains uncovered thousands of agent manifest files
Researchers at a stealth startup in Israel scanned 6,214 live domains that belong to defense contractors, Fortune 500 firms, and Big Tech companies. Their automated crawl located 8,265 instances of files named llms.txt and llms-full.txt (many sites hosted both file names). Of those, 120 files — one per different site — pointed to one or more code packages or domain names that were not registered.
Unregistered package names became a live test of agent behavior
To see what would happen when an AI coding agent encountered those references, the researchers registered a handful of the unclaimed names and hosted packages that, when executed by a machine, would reach out to the researchers’ server. Within an hour of publishing the packages, the team recorded a phone‑home response from a Fortune 500 company. Over time the beacon registered a few dozen more responses, including from additional Fortune 500 companies and startups.
The beacon also captured the chain of parent processes that spawned each install; that process data showed coding agents were involved in the activity. The researchers concluded that agent-driven automation, fed by vendor documentation and hosted manifests, was executing installs that caused machines on corporate networks to reach back to the researcher-controlled servers.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleNamed agent tools were implicated
The chain-of-process evidence the researchers recorded implicated specific coding agents, including Claude, OpenAI’s Codex, and Nous Research’s Hermes. When contacted for comment, Anthropic, OpenAI, and Nous Research did not respond by the time of publication.
Researchers’ warning: supply-chain risk and a broken trust model
The team framed the findings as a systemic problem rather than an isolated misconfiguration. “This kind of thing will be exploited. Think Solar Winds–style supply chain attacks,” the researchers warned. Their assessment — echoed in Alon Hertz’s quoted diagnosis that “the trust model is broken” — centers on two linked failures: agents treating vendor documentation as authoritative, and humans supervising those agents doing the same.
What this means for technologists, procurement leaders, and defenders
- Technologists and security teams: Expect to see unexpected “phone‑home” connections and installations triggered by automated coding agents parsing llms.txt or llms-full.txt manifests; defending against that behavior will require visibility into agent-originated processes and the ability to trace parent process chains.
- Procurement and enterprise IT leaders: The scan focused on defense contractors, Fortune 500s, Big Tech, and startups — organizations that publish vendor docs and manifests; procurement reviews of vendor documentation and package references may need to include checks for unregistered domains or packages referenced in public manifests.
- Adversaries and opportunistic actors: The researchers’ experiment—registering unclaimed names and receiving beacons—demonstrates the incentive structure. Attackers who register unclaimed package names or domains referenced in public manifests could cause agent-driven installs to reach attacker-controlled servers.
The researchers’ findings are stark and specific: thousands of manifest-like files across large corporate domains, 120 references to unregistered packages or names, and active machine callbacks after the team registered a subset of those names. The record of parent processes ties the activity to named coding agents, and the researchers conclude that both agent behavior and human oversight are failing to question vendor-supplied documentation.
Whether the corporate response will follow — changes to manifest handling, tighter vetting of vendor documents, or constraints on agent privileges — remains to be seen. The researchers have left a practical demonstration on the table: when public manifests point to unclaimed packages, someone registering those names can cause real machines on live corporate networks to call home.
