Some sites have been adding llms.txt to websites as a way to instruct how to index content. Unshockingly, this has turned into a prompt injection vector. And interestingly, it looks like many major companies' websites' have been found to be compromised with malicious instructions https://arstechnica.com/security/2026/08/claude-codex-and-hermes-installed-unowned-code-inside-corporate-networks/
EDIT: I have been informed I don't know what llms.txt is, that it is to "give agents a cheat sheet", and okay, no matter what, it seems extremely silly and bound to go badly
Christine Lemmer-Webber
npub1s7…qeul5
2026-08-28 14:09:11 UTC
Author Public Key
npub1s7kf9vtmyl2vwzwmhrkfvc66t28xlvh5c9dxgdcn2celskacu2gs0qeul5Published at
2026-08-28 14:09:11 UTCEvent JSON
{
"id": "5c23be4e614133d01547d59d9637117fe5e17bf1d18ba2e382ef5b7b6dde10a6",
"pubkey": "87ac92b17b27d4c709dbb8ec96635a5a8e6fb2f4c15a6437135633f85bb8e291",
"created_at": 1787926151,
"kind": 1,
"tags": [
[
"proxy",
"https://social.coop/users/cwebber/statuses/117173528242545639",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "Some sites have been adding llms.txt to websites as a way to instruct how to index content. Unshockingly, this has turned into a prompt injection vector. And interestingly, it looks like many major companies' websites' have been found to be compromised with malicious instructions https://arstechnica.com/security/2026/08/claude-codex-and-hermes-installed-unowned-code-inside-corporate-networks/\n\nEDIT: I have been informed I don't know what llms.txt is, that it is to \"give agents a cheat sheet\", and okay, no matter what, it seems extremely silly and bound to go badly",
"sig": "bdd47b6721f899d7a29a6457c0c7a114e952a1cbed85bfd012e6cd049eead1fb1b8007c0673b695617e311d444dd93263877772452b6492ca500993e6548effb"
}