Large llms.txt survey separated agent action requests from rare role spoofing

Signals Corps queried 113,457 sites for llms.txt and classified the content. Of the replies, 62,751 were real llms.txt text and 40,672 were HTML. In the genuine files the team classified 3,340 as including AI-agent instructions or policies. Two used explicit role-override language, while 2,035 requested some kind of action.

The action counts include deployment boilerplate, not necessarily malicious campaigns. The paper identifies 1,992 Shopify sites advertising the same Shop skill, 1,991 of them effectively repeated; a separate 18,796 Wix sites linked built-in MCP services and must not be conflated with the 2,035 action-request count. The collection used a Common Crawl CCBot user agent, so an agent-specific HTTP response could differ.

The security question is where a website's lower-trust advisory crosses into installing software, registering identity, connecting accounts or invoking a transaction. Counting suspicious text alone cannot show that an agent actually executed a command or that the instruction was malicious.

The study used a site-level classification hierarchy: each of the 3,340 files asking something of AI received one most-serious label, including 2 role overrides, 2,035 action requests, 262 steering requests, 839 guidance entries and 202 policy entries. The 2,035 action requests are not 2,035 independent attackers; 1,992 reflect Shopify's platform template, of which 1,991 are unchanged. Wix MCP and UCP links belong to separate pointer categories. A scanner that adds all of these counts or treats HTML error pages as valid llms.txt would inflate prevalence. The report is a map of potential agent instructions, not an experiment showing those sites took control of agents.

The site survey measures how often instruction-like content was served, not how often assistants complied. Most action-requesting files inherited common platform boilerplate, so interpreting the 2,035 count as independent malicious sites or successful installations would inflate the threat. The website-authority pattern requires separately proving exposure through a tool, an actual agent action, and the user's permission state before classifying a case as an executed authorization failure.