However, due to the way LLMs work, "data" and "instructions" are the same, with model developers doing their best to create the illusion of separation. And llms.txt shatters that glass wall with the ballpeen hammer of agents.
The iron curtain of software is cracking in many other locations, too. A year ago, a team of researchers showed how one could trick Gemini into doing their bidding with users' data by simply adding prompts to calendar invitations. Innocuous-looking bot skills can contain invisible text (via special Unicode characters) that hides malicious prompts.
The Model Context Protocol can be poisoned (hence "MCP poisoning") by having malicious software pose as legitimate MCP packages, intercepting and manipulating data being processed between tools. EchoLeak showed how Copilot could be tricked with a simple e-mail sent to an unsuspecting victim. Even plain webpages can catch models off-guard by simply including invisible text with instructions for the bot to process.
It's hard to directly blame the bots for the situation, too. First off, they're following literal orders, and most importantly, since llms.txt is published on the software packages' official websites, that makes it as authoritative a source as one can be . Sure, a bot could check that the content of llms.txt matches that of the actual documentation, run the domain name against a malware scanner, and so on, but doing so would be the kind of token-intensive work meant to be avoided in the first place, thus defeating the purpose of llms.txt.
Nobody's checking the data the agents consume — to quote the team, "the agent doesn't pause to check whether internal-tool actually belongs to the company. It doesn't verify the namespace on PyPI. It doesn’t notice that the documentation link points to a domain that expired three months ago." Plus, the security suites and network permissions in whichever environment the agent and/or their handler are in probably have the major package repositories all whitelisted.
The fact that many software ecosystems are subject to a high level of churn doesn't help matters. An analysis of 13 million packages showed that around 30% to nearly 60% of packages across the Node.JS, Go, and .NET worlds lost development activity within two years of their release — nasty figures, even if they include packages that are actually stable, just not frequently updated. Each abandoned package can be mentioned in an llms.txt file that didn't get updated.
Then, there's the problem that llms.txt itself is not a user-facing file. The file doesn't appear in a user's browser, and therefore, its update likely gets forgotten or indefinitely postponed.
The constant rush-to-market mentality of the modern age and the ease with which one can ask a bot to write and publish code likely doesn't help. It's exceedingly easy to kick off a new product and preemptively create documentation with placeholder names to fix later… that aren't. In big corporations, the person responsible for writing the documentation might not be the same person who does the code, while a third person might be responsible for checking everything afterward.
And in a twist of irony, any or all of these people will be using LLMs and end up subject to slopsquat/hallusquat attacks, in which the bot writing documentation or project code hallucinates predictable package names that malfeasants can calculate and squat ahead of time.
Supply-chain attacks became increasingly common as contemporary high-level languages allowed for faster development speed but also increased package and business churn. Now with agents in the mix, the situation is likely to get worse before it gets any better. As Microsoft 's Mark Russinovich et al stated, "there is no simple 'fix' for these behaviors", an assessment supported by the fact that a lot of high-level contemporary development is targeted at the problem.
Bruno Ferreira Social Links Navigation Contributor Bruno Ferreira is a contributing writer for Tom's Hardware. He has decades of experience with PC hardware and assorted sundries, alongside a career as a developer. He's obsessed with detail and has a tendency to ramble on the topics he loves. When not doing that, he's usually playing games, or at live music shows and festivals.
Key considerations
- Investor positioning can change fast
- Volatility remains possible near catalysts
- Macro rates and liquidity can dominate flows
Reference reading
- https://www.tomshardware.com/tech-industry/artificial-intelligence/SPONSORED_LINK_URL
- https://www.tomshardware.com/tech-industry/artificial-intelligence/researchers-easily-trick-fortune-500-companies-ai-agents-into-running-arbitrary-code-supply-chain-attack-via-llms-txt-guidance-file-illustrates-how-data-has-become-code#main
- https://www.tomshardware.com/my-account
- You can now play GTA V natively on a Nintendo Switch thanks to unofficial Homebrew port — game runs at 30 FPS but requires a jailbroken, overclocked Switch
- NVIDIA AI Factory Compute Is Becoming an Investable Asset Class
- Russian Starlink rival flounders after entire batch of satellites fails to reach operational altitude — many of the 16 launched hit less than half their 870km t
- Leading Publishers Bring Blockbuster PC Games and Technology to NVIDIA RTX Spark
- EFF asks California governor to veto bill that would require online age verification — Electronic Frontier Foundation argues bill would result in privacy-invasi
Informational only. No financial advice. Do your own research.