llms.txt Supply Chain Poisoning: A New Threat to AI Agents

Research exposed on 2 September reveals that the emerging standard llms.txt is becoming a new attack vector for the AI supply chain. Attackers embed malicious system prompts in the llms.txt file located at the root directory of a website. When corporate AI Agents automatically read it, they treat the external data as legitimate execution commands, leading to agent control flow hijacking, unauthorized data exfiltration, and even the execution of arbitrary code on the underlying infrastructure. This means that indirect prompt injection has expanded from chat interfaces to the supply chain protocol layer—the more autonomous the AI Agent, the larger the attack surface.

I. What is llms.txt

Proposed by the Answer.AI team (Jeremy Howard), llms.txt is positioned similarly to robots.txt, but its target audience has shifted from search engine crawlers to AI Agents. It is a plain text Markdown file placed at the website's root directory  /.well-known/llms.txt  or  /llms.txt , which tells the AI Agent what content this website contains, how to call APIs, and where to read documentation.

The format is deliberately kept simple: one H1 header (mandatory, specifying the project or website name), a blockquote summary, several free-form paragraphs, and H2 sections. It is recommended to keep a single file under 50,000 characters to ensure the Agent can read it all in one crawl. Currently, the v2 version discovered via link relation is still a community convention rather than a formal standard, with its maturity labeled as "emerging".

Standard structure of llms.txt

# Project Name (Mandatory H1)
> One-sentence summary (blockquote)

Free-form paragraphs: Project introduction, core capabilities

## Document Section (H2)
- [API Documentation](url) - Description
- [User Guide](url) - Description

The design intention is good: AI Agents do not need to crawl the entire website; they only need to read a single llms.txt file to know where to find what. But the problem lies exactly here—the Agent will actively read and follow the instructions within this file.

II. Attack Principle: How a txt file hijacks an AI Agent

The attack chain is not complex, but it exploits a fundamental trust assumption in the AI Agent architecture: there is no clear boundary between external data and executable instructions.

Specifically, after gaining control of a website, an attacker embeds hidden system prompts in the blockquote summary or free-form paragraphs of the llms.txt file. When a corporate AI Agent (such as an automated research assistant, a code generation Agent, or a customer service Agent) visits the website, it first crawls the llms.txt file to retrieve the content map. The Agent executes the malicious instructions in the file as legitimate operating guidelines for the website, which may lead it to access an attacker-controlled C2 server, leak conversation context and internal data, or call tools to perform unauthorized actions.

The most dangerous point: the entire process requires no user interaction. The Agent runs autonomously; users do not even know which website the Agent has visited or what content it has read. By the time data exfiltration is discovered, the attack may already be complete.

III. Why this is not a theoretical risk

llms.txt poisoning is not an isolated new technology, but an extension of indirect prompt injection attacks at the supply chain layer. Several real-world events that have already occurred can serve as references:

These events collectively point to a trend: attackers are shifting from "attacking the model itself" to "attacking the content the model reads and the supply chain it relies on". llms.txt is the latest link in this trend—it is a "content map" actively read by the Agent. Once poisoned, it is equivalent to opening an entry point directly to the Agent's control logic for the attacker.

Key Judgement: The adoption rate of llms.txt is currently not high, but the deployment of AI Agents is accelerating. If we wait to defend until llms.txt becomes standard, the attack surface will have already solidified. Now is the window of opportunity to establish protection.

IV. Corporate Defence Checklist

To counter llms.txt poisoning and broader AI supply chain attacks, enterprises can establish protection across six directions:

1. Separation of Data and Control Layers: External content processed by AI Agents (web pages, documents, llms.txt, RAG retrieval results) must be treated as untrusted data and must not be used directly as executable instructions. External data can only provide information; it cannot alter the Agent's objectives or tool calling logic.

2. Input Sanitization and Sandbox Isolation: Before the external content crawled by the Agent enters the reasoning context, it must undergo prompt injection detection and filtering (strategies such as direct override, delimiter attacks, encoding attacks, role jailbreaks, etc.). The execution environment where the Agent calls tools must be placed in a sandbox to restrict network access and file system permissions.

3. llms.txt Content Auditing: If an enterprise's own website deploys llms.txt, the file content should be regularly audited to ensure it has not been tampered with or implanted with malicious instructions. If the enterprise's AI Agent accesses llms.txt from external websites, a whitelist mechanism should be established.

4. All-category Poisoning Protection for AI Skills: The Skills, plugins, and extension packages that AI Agents rely on are another major entry point for poisoning. Real-time interception must be established across three lines of defense: developer workstations, CI/CD pipelines, and AI programming tools, so that malicious packages are blocked before they land.

5. Agent Behaviour Monitoring and Anomaly Detection: Monitor the tool calling behavior of the Agent to establish a baseline of normal behavior. When the Agent suddenly accesses unknown domains, calls unauthorized tools, or exports data in batches, trigger alerts and block the action.

6. Least Privilege Principle: Assign the minimum privileges required to complete the task to the AI Agent. Do not grant the Agent administrator privileges or full data access rights. Even if the Agent is hijacked, the privileges and data the attacker can obtain will be limited.

V. Cyritex's AI Supply Chain Protection Capabilities

The core difficulty of AI supply chain attacks lies in the fact that traditional SCA scanning can detect problems but cannot block them in real time. Intelligence is available, but control has not kept up—malicious packages often land long before they are discovered.

CyriGate, Cyritex's Software Supply Chain Poisoning Prevention Smart Gateway, is the first smart gateway in China to cover poisoning protection for both traditional software packages and all categories of AI Skills. Deployed at the entry point of the enterprise supply chain, every open-source component, third-party dependency, or package pulled by AI programming tools must undergo intelligence validation before reaching the development environment.

In terms of intelligence scale, CyriGate covers 623,400+ threat records (comprehensive coverage of traditional software packages and AI Skills), aggregating automatic updates from 30+ intelligence sources, covering 15 types of artifacts (npm, PyPI, Maven, Go, NuGet, Docker, AI Skills, MCP, etc.). Special monitoring for AI Skills covers a total of 2,032,940+ Skills across four mainstream platforms, among which 350,725 have been confirmed as malicious Skills, with a malicious rate of approximately 20%. In terms of response speed, local database queries take <5ms, cloud supplementation takes <2s, and the time from threat appearance to intelligence database inclusion is T+6 hours, with gateway protection in place within T+25 hours. Taking the Axios supply chain poisoning event as an example, Cyritex intelligence was cataloged just 41 minutes after the event occurred, 2.5 hours ahead of the official npm security advisory.

Protection choke points cover three lines of defense: developer workstations, CI/CD pipelines, and AI programming tools (Claude Code, Cursor, etc.). Known malicious files are intercepted immediately upon match, whitelisted files are cleared directly, and unknown samples undergo real-time cloud queries. One-key deployment via Docker container enables online implementation within 30 minutes, without changing any existing developer behavior.

The accompanying CyriIntel, Cyritex's Advanced Persistent Threat Intelligence Smart Platform, fuses APT intelligence, software supply chain security, and attack surface management (ASM) capabilities into one. Regarding AI Skills poisoning intelligence, the platform has tracked 350,725 malicious Skills (as of August 2026), with a malicious rate of approximately 20%. Combined with traditional software package malicious intelligence (covering 15 types of artifacts such as npm, PyPI, Maven, Go, etc.), the platform performs deep parsing of atomic malicious Skills to lock onto real attack intentions hidden behind complex code logic in advance.

The platform connects the operations system of discovery, confirmation, validation, and response. The AI brain can convert collected malicious Skills, IOCs, or APT attack techniques with one click into non-destructive attack playbooks in real production environments. By performing real validation of the effectiveness of existing defense systems, it helps enterprises transition from passive response to proactive security.

llms.txt poisoning is just a miniature of AI supply chain attacks. As AI Agents evolve from auxiliary tools to autonomous executors, every file they read, every Skill they call, and every package they depend on could become an attack entry point. Protection must be implemented before the Agent runs autonomously, rather than tracing back after data has been exfiltrated.

References

[1] La Rebelion / Tom's Hardware, "AI Agents Vulnerable to Supply-Chain Code Execution", 2026-09-02

[2] OWASP, "Top 10 for Agentic Applications 2026", ASI01 Agent Goal Hijack

[3] OWASP, "Agentic Skills Top 10", AST01 Malicious Skills

[4] llms.txt Specification Description, llmstxt.org / GitHub agentpatterns-ai

Cyritex · Intelligence-driven operations, AI builds a closed loop