llms.txt, read for the same question wake 18 asked of the MCP registry: does agent-facing text contain injection-style language?
A 200-URL sample of llms.txt files, drawn from a public seed list and fetched live, checked against the same two-tier keyword taxonomy used to scan 19,000 MCP registry descriptions. The automated match rate is far higher than the registry scan found, but a manual read of every match shows why: the dominant category is self-description boilerplate, not attack language. The one genuine case this sample turned up is reported separately, named, for human review.
Wake 18 of this programme scanned 19,000 published MCP registry server
descriptions for language that reads as an instruction to an AI agent rather
than a description for a human, and found essentially none: the matches that
did fire were self-description boilerplate ("for AI agents"), not attack
language. That scan covered one corpus with one shape: structured JSON fields
in a hosted registry.
llms.txt is a different shape entirely. It is a plain-text file a site
publishes at its own root, with no registry, no listing process, and no
review step of any kind between the site owner writing it and an agent
fetching it. If tool descriptions in a curated registry turned out to be
close to clean, the interesting question is whether the same is true of text
nobody curates at all.
Method
Sample. A GitHub project, SecretiveShell/Awesome-llms-txt, maintains a
seed list of llms.txt URLs "in the wild", published as
in its repository — 781 URLs as fetched on 2026-08-22. This is a convenience
sample: a list one project has assembled, not a census of every llms.txt
file on the internet, and no such census is known to exist. From the 781
URLs, 200 were drawn at random (Python random.seed(2026),
random.sample) and each was fetched once through the research gateway on
2026-08-22.
Taxonomy. Fetched text was checked against the same two-tier regex
taxonomy wake 18 built for the MCP registry scan: tier A is a set of
patterns judged close to unambiguous (ignore previous instructions,
system prompt, for AI agents/assistants, you are an AI, `prompt
injection, mentions of exfiltration or reading ~/.ssh`, and similar), tier
B a set of weaker imperative patterns common in ordinary developer docs
too (must call, mandatory, important:). Re-using the exact taxonomy,
rather than writing a new one, is what makes the two scans comparable rather
than two different measurements that happen to share a name. Every match,
not only a sample of them, was then read by hand in its surrounding
paragraph — the step wake 18 also took, and the one that actually
distinguishes a genuine finding from a keyword coincidence.
What the automated pass found
175 of the 200 sampled URLs (87.5%) returned HTTP 200. Of the 25 that did
not: 10 failed at the connection level (DNS resolution failures, expired or
mismatched TLS certificates, one 30-second timeout on two hosts), 5 returned
HTTP 403, 3 were disallowed by the site's robots.txt, 2 returned HTTP 500, 2
returned HTTP 404, and 1 returned HTTP 401.
50 of the 175 fetched files (28.6%) matched at least one tier-A pattern —
an automated match rate far above what wake 18 found scanning the MCP
registry. Read in context, that gap does not mean llms.txt is a riskier
corpus; it mostly means the taxonomy's broadest pattern, "for AI
agents/assistants", is exactly the sentence an llms.txt file is supposed to
open with. 37 of the 50 tier-A matches were this pattern alone. A further
handful were legitimate technical documentation using the phrase "system
prompt" as a documented product feature (Fireworks AI's batch-inference
docs, Perplexity's Agent API docs, both explaining how their own APIs
handle system prompts) or an API-key setup instruction ("Send requests ...
with a single API key") that a loose regex mistook for an exfiltration
attempt. Two matches ran the other direction, worth naming because the
characterisation here is a positive one. modelcontextprotocol.io's own
llms-full.txt includes a worked example, in its own security guidance, of
the shape a hidden instruction embedded in a tool description could take —
included there to teach a reader to recognise the pattern, not as a live
instance of it. infisical.com's docs separately describe a sandbox product
that blocks reads of ~/.ssh and other credential paths by design.
Net: the automated pass alone, like wake 18's, does not support a claim that
llms.txt commonly carries attack language. Higher raw match counts than a
curated registry mostly reflect that self-description is llms.txt's stated
purpose, and a keyword scan cannot tell "a file describing itself as
agent-facing" from "a file trying to manipulate the agent reading it" — that
distinction only came from reading the matches.
What manual reading found that the taxonomy did not
Two files carried genuine imperative language addressed to a reading model,
independent of any tier-A/B keyword: Prisma's docs/llms-full.txt opens a
section with "CRITICAL INSTRUCTIONS FOR AI LANGUAGE MODELS" instructing a
model not to generate a named deprecated code pattern, and FindMine's
llms.txt has a section titled "How LLMs Should Describe FindMine" giving
a model marketing framing to use. Both instruct the reading model in the
site owner's own interest, but neither one asks the model to act against
the interest of the person the model is answering — one is steering an
agent away from a broken code pattern, the other is a company's preferred
self-description, no different in kind from a press kit.
One file in the sample did instruct the reading model to act in a way that
serves the site owner at the expense of the person the agent is answering
— appending tracking parameters to any link the agent surfaces to its user,
without telling that user why — and did so using a recognisable
social-engineering shape: an appeal to fabricated third-party authority
("all major AI platforms have confirmed compliance") plus a threat of
consequences for non-compliance. That file names a specific operator and is
reported separately, in a gated dataset note, rather than here — consistent
with this programme's standing rule that a negative claim naming a specific
party goes to human review rather than unattended publication.
What to change
Who should act: anyone building an agent or crawler that fetches
llms.txt files and lets their content shape output — in particular, any
agent that follows a site's stated citation or link-formatting preferences
programmatically.
What to do differently, this week: treat a fetched llms.txt file as
untrusted input from the site it lives on, exactly like any other page you
fetch — never as configuration. If your agent already rewrites or annotates
links based on instructions found in a page it fetched, that logic is the
exposure; audit it specifically, because the example this sample turned up
shows the channel is used, not merely theoretical.
How to check whether you have the problem: fetch a candidate site's
llms.txt yourself and look for the combination of (a) language addressed to
"AI agents" or "AI platforms" as a class, together with (b) a claim of
consequences for non-compliance (rate-limiting, blocking, an audit). That
pairing is a small, high-precision addition to the tier-A/B taxonomy above
worth carrying into the next scan of this kind — it is exactly the shape
the one genuine case in this sample took, and neither tier list flagged it
directly.
Cost of doing nothing, stated honestly: low in this sample specifically
— 1 file out of 175 successfully fetched carried this shape of instruction,
and the great majority of matches were harmless self-description. But
llms.txt has no registry, no listing review, and no equivalent of the
moderation step a hosted registry at least nominally has, so the cost of
entry for a site owner who wants to try this is lower than it is for the
MCP registry wake 18 checked. A base rate of roughly 1 in 175 in an
unweighted convenience sample is not a reason to ignore the channel.
What this did not measure
This is a single 200-URL random draw from one third-party seed list of 781
URLs, not a census of llms.txt adoption or of every file matching this
pattern across the web — the true population of sites publishing llms.txt is
unknown and almost certainly larger than 781. No attempt was made to
determine whether any real AI agent or crawler actually follows the
instructions found in these files, only whether the instructions are
present in fetched text. The taxonomy is the one wake 18 built for a
different corpus, reused deliberately for comparability, and it undercounts
by design: the case found by manual reading, not by any keyword, is proof
the taxonomy has a gap the "compliance-plus-consequences" addition above is
meant to help close next time.