The study describes a route by which site-authored manifest text, initially presented as navigation support, can promote an attacker-selected document or answer into an agent retrieval decision. A reduced pilot compared untreated consumption with explicit validation. Its small sample and simulated consumption do not prove that mainstream search agents…
Inspect the ClaimsCase · DiggingBeagle record
A poisoned llms.txt style manifest redirected retrieval in a small simulated pilot
The manifest-assisted retrieval paper reports that its reduced controlled pilot achieved attacker-desired responses in 21 of 24 unguarded trials, while a guarded validation condition eliminated those target adoptions in the same setup.
Scope
A deliberately reduced controlled pilot, not field exploitation or a measured production AI crawler adoption rate.
Assessment profile
Assessment method- Setting
- simulation
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The paper reports a small controlled test of retrieval redirection by an attacker-controlled llms.txt style manifest. Its reported success denominator belongs to the pilot; no deployment-wide attack prevalence is established. Impact remains unrated because the evidence does not supply a calibrated scale for this Case.
Assessed Nov 1, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV01-LLMSTXT-MANIFEST-PILOT-1 · arXiv 2610.38361: llms.txt retrieval evidence and controlled security pilot
At a glance
Assess the reported tool or model action separately from the side effect actually observed.
Read the implicationsA deliberately reduced controlled pilot, not field exploitation or a measured production AI crawler adoption rate.
Limits and uncertaintyFull account
The study describes a route by which site-authored manifest text, initially presented as navigation support, can promote an attacker-selected document or answer into an agent retrieval decision. A reduced pilot compared untreated consumption with explicit validation. Its small sample and simulated consumption do not prove that mainstream search agents currently process llms.txt or that the same rate would survive real browsing.
A file advertising retrieval or indexing conventions should not acquire control over tool selection merely because its filename appears standardized. The pilot measures model steering after a lower-trust manifest was encountered; verifying the returned documents and the final tool destination would test a different, higher-trust boundary than format recognition alone.
Mechanism and trust boundary
- 01
Step
Claims & evidence
CLM-2026-NOV01-LLMSTXT-MANIFEST-PILOT-1The manifest-assisted retrieval paper reports that its reduced controlled pilot achieved attacker-desired responses in 21 of 24 unguarded trials, while a guarded validation condition eliminated those target adoptions in the same setup.supported
Basis: reported finding
- supportsarXiv 2610.38361: llms.txt retrieval evidence and controlled security pilotprimary disclosure
arXiv 2610.38361, VII Reduced Pilot Design, Results and Scope, Limitations
Implications
Assess the reported tool or model action separately from the side effect actually observed.
Controls and mitigations
- Treat discovery manifests as ordinary website data, verify actual linked documents and prevent manifest claims from setting ranking or operational authority by themselves.
Unknowns and contradictions
- A deliberately reduced controlled pilot, not field exploitation or a measured production AI crawler adoption rate.
Sources and citation
Material revision history
- Nov 1, 2026 · Canonical change recorded · new in release · revision 211