The report
A website can place suggestions for AI-oriented retrieval in an llms.txt file, but the name of that file does not grant it authority over the assistant consuming it. A research paper tested this distinction in a reduced pilot: after supplying adversarial manifest-style content directly, its scoring system recorded the attacker's target in 21 of 24 raw responses, with one additional response unresolved. A guarded condition recorded no confirmed adoptions, also with an unresolved response.
The denominator matters. These were scripted input conditions, not 24 observed browser compromises, and the pilot did not execute live retrieval and downstream actions. In the same paper, the authors report that their small observation of tools found no automatic llms.txt requests, while a separate non-probability traffic study showed little recorded retrieval for detected files. Neither measurement establishes broad adoption by production AI search products.
A document can recommend evidence but cannot certify it
An attacker who controls a manifest may influence which linked document or answer the agent favors if the agent promotes suggestions into instructions. A safer route keeps the manifest at website-data trust level, verifies the linked documents through their actual origins and evaluates any requested action independently. The Case records what the reduced pilot supports, rather than treating its success fraction as a general attack rate.