227 install commands in corporate docs point at packages nobody owns

Your llms.txt is a config file for other people's agents. That's the part most teams publishing one didn't think through.

A study published August 27 scanned 6,214 live domains belonging to defense contractors, Fortune 500 companies and Big Tech, and found 227 install commands sitting in llms.txt and llms-full.txt files that resolve to package names nobody has registered. Claude, OpenAI's Codex and Nous Research's Hermes each executed those commands when they read the documentation. The researchers registered proof-of-concept packages against the dangling names and confirmed that a few dozen companies, some of them Fortune 500, installed and ran that code inside their own networks (Ars Technica).

Slopsquatting used to be a hallucination problem. A model invented a plausible package name, someone registered it, and you got owned when the model recommended it again. The mitigation was straightforward: verify the package exists and has history before installing. This is different. The install command is real, it's in your own documentation, a human wrote it, and it's wrong because the package was renamed, deprecated, moved to a scoped name, or was never published in the first place. The agent has no reason to be suspicious. The docs are first-party.

What makes this land harder than the average supply-chain story is who's exposed. llms.txt is a file you publish specifically so agents find and follow it. Teams added it in the last twelve months for discoverability, copied the install steps out of an old README, and never audited them again. The file is doing exactly what it was built to do.

Go grep your published docs for install commands right now. npm install, pip install, uv add, cargo add, gem install, go get. For every package name that appears, check that it resolves to something you or a party you trust actually controls. If it doesn't, either register the name defensively or delete the line. Registering a name you don't intend to publish costs nothing on npm and PyPI and closes the hole permanently. Then add a CI check that diffs install commands in llms.txt against your lockfile, because this drifts every time someone edits docs.

The connecting thread to everything else today: agents execute what documentation tells them to. Johann Rehberger's chain (below) works by feeding Claude a 415 status code so it switches from WebFetch to curl. The instruction-privilege paper (also below) proves that harnesses promote low-privilege content into the instruction slot at all six coding agents tested. Same failure, three different entry points. Content the agent reads becomes content the agent obeys, and no model-side instruction hierarchy has fixed it.