Security researchers just proved that the file telling AI agents how to install your software can also tell them to install malware instead.
Researchers at Pandex scanned 8,565 llms.txt files - the README-style guides that tell AI agents which packages, domains, and setup commands to use - and found 237 references to software packages that are broken, expired, or up for grabs. They registered a handful of those abandoned names themselves and waited. Four minutes after publishing, an AI agent had already fetched and run their test payload, triggered by nothing more suspicious than a generic prompt asking it to build a project using a vendor's SDK. No prompt injection, no phishing link, no human in the loop - just an agent trusting a text file.
The gap in compliance rates is the real story here. Pandex reports that newer, more autonomous models it labels as GPT-5 variants followed the bad instructions more than 90 percent of the time, while Claude Opus 4.8 running on medium effort did so only 30 percent of the time. That is not a security feature so much as a side effect of caution, and it suggests agent autonomy and agent gullibility are currently rising together.
This is the same trick as prompt injection via calendar invites or poisoned MCP packages, just aimed at a file nobody ever reads with human eyes.